Re: [PHP-DB] Login query

On Thu, Feb 18, 2010 at 4:40 PM, Ron Piggott <[email protected]> wrote:
> I am wondering what others do for a login query.  I think there could be
> two results: correct e-mail & password; correct e-mail & wrong password
>
> So far my login query is:
>
> SELECT * FROM `member` WHERE `email` = '$my_email' AND `pass` LIKE
> BINARY '$my_password' LIMIT 1
>
> This wouldn't tell me if the user has the wrong password.  Is there a
> better way to do this?
>
> Ron
>
>
>
>

bad bad bad! never do a like on a password. If there are two passwords
that are close, the unauthorized user might get in when they
shouldn't.

There are two usual approaches:
1. Select the user (providing that the user is distinct) and compare
the password in PHP. On a match, allow access.
2. Select the user and password and see if the results return a row.
If no row is returned, then access is not granted. If there is a row,
then access is granted.

HTH

-- 

Bastien

Cat, the other other white meat