Question

Here it is my query to find username and password stored in mysql db made using codeigniter php framework.

 public function find_user($username,$password)
{
    $sql = "SELECT *
            FROM users_login
            WHERE username = ? AND password = ?";

    $query = $this->db->query($sql,array($username,md5($password)));

    if($query->num_rows() == 1)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

where the db is made: id,username,password. there is some mistake because it doesn’t work as should be?

Here it is my controller. Maybe the error it is here:

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');


class Login extends CI_Controller 
{
    public function __construct() 
    {
        parent::__construct();
        $this->load->database(); /* This function it's used to connect to database */
        $this->load->model('User','user'); /* This call the model to retrieve data from db */
    }


    public function index()
    {
        if(!file_exists('application/views/login.php'))
        {
            show_404();
        }

        $this->load->helper('form');
        $this->load->library('form_validation');

        $this->form_validation->set_rules('username','username','trim|required|xss_clean');
        $this->form_validation->set_rules('password','password','trim|required|xss_clean|callback_check_pass');

        if($this->form_validation->run() == FALSE)
        {
            $data['title'] = "User Access";
            $this->load->view('login', $data);
        }
        else 
        {   
            $data['title'] = " ";
            $this->load->view('/templates/index',$data);            
        }
    }

    public function pass_check($pass)
    {
        $username = $this->input->post('username');

        $result = $this->user->find_user($username,$pass);

        if($result)
        {
            return TRUE;
        }
        else
        {
            $this->form_validation->set_message('pass_check','Invalid username or password! Try Again, please!');
            return FALSE;
        }
    }
}

Answer 1

Mazzy, first of all, remember this:

if($query->num_rows() == 1)
{
    return TRUE;
}
else
{
    return FALSE;
}

Can be written as:

return $query->num_rows() == 1;

I don’t know much about PHP / CodeIgniter preferred syntax, but it is much more compact (and comfortable, for me).

Now, trying to dig on your issue. What does $query->num_rows() return for a particular user/password combination that is not present in the DB?

If it is matching something (greater than 0) then you should check the data manually and see if there is a record in the DB matching that user/password combination.