Re: [cgiapp] checking passwords using SQL

[Thilo Planz <suppressed>]

> A little bit of an optimization and security check - if all you are 
> doing
> is comparing if the username and password match, why not let SQL do it?
>
>       my $query = "SELECT count(*) FROM user WHERE USER_ID = ? and
> USER_PASSWORD = ?";
>       my $sth = $dbh->prepare($query);
>       $sth->execute($user_ID, $pass_word);
>       my ($valid_login) = $sth->fetchrow_array ();    #This could also 
> be
> changed....

Good call, but one caveat:

SQL is case-insensitive.
So the password and userid will be compare case-insensitively as well.
(I found out about this the hard way...)

You could fix this by declaring the columns or the comparison as binary 
(at least in MySQL).

Thilo


---------------------------------------------------------------------
Web Archive:  http://www.mail-archive.com/suppressed/
To unsubscribe, e-mail: suppressed
For additional commands, e-mail: suppressed