At this moment users can create an account at my website (username, password, email)
This wil create an entry in the database which stores the username, the hash of the password and the email adress and will set the level of the user to 0. After this it wil send an email with an url that contains the id of the user and a new hash of the hashed password.
$emailhash = password_hash($passwordHash, PASSWORD_BCRYPT, $options);
$url = "domain/validation.php?id=$id&hash=$emailHash";
At the validation page where the url points to, it wil use the hashed password as password and the hash from the email to check if the user is using an existing email adress.
password_verify(hashedPasswordFromDB, hashOfHashFromEmail);
Is this is a safe way to validate a user or should I add an extra table/column for an extra hash? And what are the pro's/cons of my current method and/or another method? (eg. simpler table...)
EDIT: In case a user want to change his email adress ( something I'm adding at the moment ), I want to implement the same method (sending an url which contains the id, new email adress and a new hash of the hashed password + the new email adress). In my opinion this looks a bit devious but I don't see another way to change it.