function confirm_image($confirm_type, &$s_hidden_fields, $max_attempts = 0, $max_attempts_error = '')
{
	global $db;

	$sql = 'SELECT session_id
		FROM ' . SESSIONS_TABLE;
	$result = $db->sql_query($sql);

	if ($row = $db->sql_fetchrow($result))
	{
		$sql_in = array();
		do
		{
			$sql_in[] = (string) $row['session_id'];
		}
		while ($row = $db->sql_fetchrow($result));

		if (sizeof($sql_in))
		{
			$sql = 'DELETE FROM ' . CONFIRM_TABLE . '
				WHERE ' . $db->sql_in_set('session_id', $sql_in, true) . '
					AND confirm_type = ' . $confirm_type;
			$db->sql_query($sql);
		}
	}
	$db->sql_freeresult($result);

	if ($max_attempts)
	{
		$sql = 'SELECT COUNT(session_id) AS attempts
			FROM ' . CONFIRM_TABLE . "
			WHERE session_id = '" . $db->sql_escape($user->session_id) . "'
				AND confirm_type = " . $confirm_type;
		$result = $db->sql_query($sql);
		$attempts = (int) $db->sql_fetchfield('attempts');
		$db->sql_freeresult($result);

		if ($attempts > $max_attempts)
		{
			trigger_error($max_attempts_error);
		}
	}

	$code = gen_rand_string(mt_rand(5, 8));
	$confirm_id = md5(unique_id($user->ip));
	$seed = hexdec(substr(unique_id(), 4, 10));

	// compute $seed % 0x7fffffff
	$seed -= 0x7fffffff * floor($seed / 0x7fffffff);

	$sql = 'INSERT INTO ' . CONFIRM_TABLE . ' ' . $db->sql_build_array('INSERT', array(
		'confirm_id'	=> (string) $confirm_id,
		'session_id'	=> (string) $user->session_id,
		'confirm_type'	=> (int) $confirm_type,
		'code'			=> (string) $code,
		'seed'			=> (int) $seed)
	);
	$db->sql_query($sql);

	$confirm_image = '<img src="' . append_sid("{$phpbb_root_path}ucp.$phpEx", 'mode=confirm&amp;id=' . $confirm_id . '&amp;type=' . $confirm_type) . '" alt="" title="" />';
	$s_hidden_fields .= '<input type="hidden" name="confirm_id" value="' . $confirm_id . '" />';

	return $confirm_image;
}