password checker

[magda muskala]

hi,
I have a little problem with the following part of my code.
I use post method to get the password from the form [$first ].
Because there is an encrypted password in mysql database, I check with
$pass = mysql_query("Select password('$unencryptedPass')");
while($row = mysql_fetch_array($unencryptedPass))
{

$encryptedPassw = $row[0];
}
how the encrypted password looks like.
Then I make a simple query:
mysql_query("Select login, password from edv_verantwortliche where
login = '$login' AND password = '$encryptedPassw'") or
die("authorization failed");
But it doesn' t seem to work. I could login every time.

I have checked all values with echo method - they are correct...
Could somebody help me, please.

TIA

[Tom Thackrey]

On 5-Oct-2003, eu******@student.euv-frankfurt-o.de (magda muskala) wrote:

hi,
I have a little problem with the following part of my code.
I use post method to get the password from the form [$first ].
Because there is an encrypted password in mysql database, I check with
$pass = mysql_query("Select password('$unencryptedPass')");
while($row = mysql_fetch_array($unencryptedPass))
{

$encryptedPassw = $row[0];
}
how the encrypted password looks like.
Then I make a simple query:
mysql_query("Select login, password from edv_verantwortliche where
login = '$login' AND password = '$encryptedPassw'") or
die("authorization failed");
But it doesn' t seem to work. I could login every time.

I have checked all values with echo method - they are correct...
Could somebody help me, please.

You will only die if mysql encounters an error. Not finding any rows is not
an error. Also, you can do it all in one SELECT.

try:

$rs = mysql_query("select login,password from edv_verantwortliche where
login=$login and password=password('$unencryptedPass')") or die('mysql
error: ',mysql_error());
if (mysql_numrows($rs)==0)
{
echo 'Authorization Failed.';
exit();
}
// authorization OK
}

--
Tom Thackrey
www.creative-light.com
tom (at) creative (dash) light (dot) com
do NOT send email to ja*********@willglen.net (it's reserved for spammers)