Reactivation of users account information and registration page

[toplisek]

If I have users and registration page has e-mail for users. The same is account page if user would like to change his e-mail address.

In the registration page:
Is correct that user can create new username and the same e-mail address or I should not allow this?

In the account page:
Username is unique in db.
- If user would like to change his e-mail, can be his e-mail address as one e-mail that is already in db for another user?
- what should be reseted if user changed his e-mail? Should I reset password or other value that it can not be logged if user does not reactivate link. Link is sent in his e-mail box.

Need help

[mwinter]

In the registration page:
Is correct that user can create new username and the same e-mail address or I should not allow this?

Generally, no, at least if a person is only allowed one account. Though it's possible for more than one person to share an e-mail address - some home users, for example, might not set up separate mailboxes or aliases for each member - allowing duplicate addresses isn't usually the done thing. Indeed some sites use the e-mail address itself as the user name.

In the account page:
Username is unique in db.
- If user would like to change his e-mail, can be his e-mail address as one e-mail that is already in db for another user?

That depends on what you think about the previous point. Can a user have multiple accounts? Do you feel it that it's reasonable to associate a given e-mail address with only one person?

- what should be reseted if user changed his e-mail? Should I reset password or other value that it can not be logged if user does not reactivate link. Link is sent in his e-mail box.

There's no need to reset the password, though you could prompt the user to enter their password even though they've already logged in. As for sending verification e-mails, that would depend on why you want the e-mail address in the first place. If it's necessary, for one reason or another, then you might want to flag the account of some that changes their e-mail address, forcing them to verify it. If you did that, though, ensure that they can reverse the change: if new address contains an error, they could never correct it, and never log back in.

Mike