Email vs Mobile Phone Verification

[venedude]

So I'm trying to get users registered and verified using either their email or phone number. Two things I'm wondering what direction to go depending on UserSpice design:

1- Should I just store the user's mobile number under "username" and set the below in User.php and build a separate path for verification?
if(is_numeric($user)){
$field = 'username';

2- Store the user's mobile number under "email" and build additional logic on top of the existing email verification code that uses a SMS API, instead of email, to verify the mobile?

What route would you guys go? I guess if we wanted to properly store values, I would go for a 3rd option to store the mobile phone under "billing_phone" and just build everything required for that from scratch... But trying to keep it simple here.

[Trioxin]

I would add a field since it would be far easier to just write a new function or method in than modifying even more of the existing code than you'd otherwise have to. That and typically a site verifies both unless you're only wanting phone and not email. It's good to collect emails though and then you can have multi-factor authentication.

[mudmin]

I agree. I would add a totally separate field. And then when it comes to phone numbers, if you are going to deal with international users, you probably have to deal with country codes, etc.

Personally, I would write something that would remove all special characters from phone numbers as well. Sorry I missed this post earlier.

[venedude]

Thanks for your suggestions! I think keeping the mobile phone stuff separate and adding a new field is probably a good idea. I just hate modifying the DB when there are so many unused fields

The plan is to have either phone or email verification, not both.

[mudmin]

The extra fields really only have thousandths of a second impacts on the db. A lot of it goes back to the initial usercake code base. It's all been rewritten from scratch, but we kept some of the db fields the same so people could upgrade from UC. We've deprecated company, so you can store it in there if you want.

[Trioxin]

Yeah that or you could just remove any field that isn't referenced in the code. Then just use something like Twilio or Tropo for phone verification and change the login code to use the phone number. All is trivial but the phone number verification where you'll need a callback script for SMS/Voice provider.

[Trioxin]

Maybe share your callback script here in the forum after you code it. It would be useful to people.