[eluser]Dahak-II[/eluser]
I don't see why not.
What I've done in the past is have the new user account added, but not flagged as 'validated' (only 'validated' accounts are granted access). At the time of account creation, I build a random string - as you are doing - and add it to the account record.
When the user clicks on the 'verify/email/uniquestring/' link, the controller function simply looks for the record with the matching 'uniquestring', marks the user record as validated and clears the validation string field.
If the 'uniquestring' doesn't exist in the user database, throw out an error message.
If you do something like that, I'd recommend checking to see if the randomly-generated string already exists in the user database, in the unlikely event that it matches a currently un-validated users' validation string (if found, generate a new one).
