Menu
Community /Pin to ProfileBookmark
@NogDogNov 28.2005 — #If you want to use the MySQL password function, it's pretty straight-forward. When you create/modify the user's password, you store it in the database:
When checking the password:
@NogDogNov 28.2005 — #It would appear that $user and $password are not set (thus the empty quotes inside the relevant places in the query. Either change those variables to whatever you are using in your login script to store the login name and password input by the user, or change the variable names you use to store them. @NogDogNov 28.2005 — #Use backwards quotes (or sometimes called back-ticks) around column and table names, not regular quotes:
(You probably only need the back-ticks around the password column name, as it is a reserverd word. But using it on all the table/column names doesn't hurt.)
MySQL Storing Password
ok I am going to make an admin center for my script. The admin password is going to be stored in a mySQL database. I’m going to get the password and check if its the same as the one enterted. The thing is I want to know if there is some special security feature I should use.
Sign in
to post a comment11 Comments(s) ↴
0
@NogDogNov 28.2005 — #If you want to use the MySQL password function, it's pretty straight-forward. When you create/modify the user's password, you store it in the database:[code=php]
# assume $user and $password have the user name and password values
$query = "INSERT INTO users SET name = '$user', password = PASSWORD($password)";
$result = mysql_query($query) or die(mysql_error());
if(mysql_affected_rows($result) == 1)
{
# added row successfully
}
[/code]When checking the password:
[code=php]
$query = "SELECT * FROM users WHERE user = '$user' AND password = PASSWORD('$password')";
$result = mysql_query($query) or die(mysql_error());
if(mysql_num_rows($result) == 1)
{
# found exactly one match so we're good to go
}
[/code]0
@NogDogNov 28.2005 — #0
@NogDogNov 28.2005 — #Use backwards quotes (or sometimes called back-ticks) around column and table names, not regular quotes:[code=php]
$query = "SELECT * FROM users WHERE user = '$user' AND password = PASSWORD('$password')";
[/code](You probably only need the back-ticks around the password column name, as it is a reserverd word. But using it on all the table/column names doesn't hurt.)