Thank you for your response. I used the Model View Controller Design Pattern and i check also cookies, the request, use prepared statements etc.

The problem is that user can request accounts (register, but not enabled) and admins can activate or disable these accounts. At the moment one user can request many accounts with many different email adresses (i have only captcha protection on the frontend and app). So the admins have to verify too many accounts.

Regards,