StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>The usage you're trying to do is as follows:</p> <pre><code>$checkquery = $db->select() ->from("users", array("num"=>"COUNT(*)")) ->where("login = ?", $login) ->where("password = ?", $password); $checkrequest = $db->fetchRow($checkquery); echo $checkrequest["num"]; </code></pre> <p>I have a couple of other tips:</p> <ul> <li>Your query doesn't distinguish between login not found and incorrect password.</li> <li>Your passwords may be stored in plain text, which is a <a href="http://www.nytimes.com/external/readwriteweb/2009/12/16/16readwriteweb-rockyou-hacker-30-of-sites-store-plain-text-13200.html" rel="noreferrer">security risk</a>. You should use a <a href="http://www.codinghorror.com/blog/2007/09/youre-probably-storing-passwords-incorrectly.html" rel="noreferrer">one-way hash function and salting</a>.</li> </ul> <p>I would restructure the query like this:</p> <pre><code>$checkquery = $db->select() ->from("users", array("pwd_is_correct"=> $db->quoteInto("(password = SHA1(CONCAT(salt, ?)))", $password))) ->where("login = ?", $login); $checkrequest = $db->fetchRow($checkquery); if ($checkrequest === false) { echo "no such login\n"; } else if ($checkrequest["pwd_is_correct"] > 0) { echo "login and password are correct\n"; } else { echo "login found but password is incorrect\n"; } </code></pre> <p>You don't have to report the different cases to the user -- in fact it's best security practice <em>not</em> to tell them which of the login or password is incorrect. But you might want to know in your own code so you can lock out an account that's receiving a lot of failed passwords.</p> <p><code>SHA1()</code> is not as good as <code>SHA2()</code> which is <a href="http://bugs.mysql.com/bug.php?id=13174" rel="noreferrer">available in MySQL 5.5</a> and later.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload