Question

I am trying to create a login screen for an iphone application using sqlite3 to store the login credentials.

The following is the function I am using to handle the authentication:

-(void) enter
{
    const char *dbpath = [databasePath UTF8String];
    sqlite3_stmt    *statement;

    if (sqlite3_open(dbpath, &DBLogin) == SQLITE_OK)
    {
        NSLog(@"Connected to Database");
        NSString *querySQL = [NSString stringWithFormat:@"SELECT id FROM User WHERE id=\"%@\"",login.text];
        NSString *s = password.text;
        const char *query_stmt = [querySQL UTF8String];
        NSLog(@"String is %s",query_stmt);
        NSLog(@"Pass is %@",s);
        if (sqlite3_prepare_v2(DBLogin,query_stmt, -1, &statement, NULL) ==!SQLITE_NULL)
        {
            NSLog(@"Executed Correctly");
            querySQL = [NSString stringWithFormat:@"SELECT password FROM User WHERE password=\"%@\"",password.text];
            query_stmt = [querySQL UTF8String];
            const char *f= [login.text UTF8String];
            NSLog(@"String is %s",query_stmt);
            NSLog(@"Pass is %@",s);
            //   const char *l = [login.text UTF8String];
            //  sqlite3_bind_text(statement, 1, query_stmt, -1, SQLITE_STATIC);
            if (sqlite3_prepare_v2(DBLogin,query_stmt, -1, &statement, NULL) == !SQLITE_NULL)
            {
                if(sqlite3_bind_text(statement, 1,f , -1, SQLITE_STATIC))
                    status.text= @"Congratulations";
            }
            else
            {
                NSLog(@"error");
            }
        }
        else
        {
            NSLog(@"Failed");
            status.text =@"ERROR!";
        }
    }
}

And this is my schema for the database:

CREATE TABLE User (id varchar(20) PRIMARY KEY, password varchar(20));

I think there is something wrong with the way I am passing the details of login.text or password.text. According to NSLog it passes the right values but it seems to fail to check whether it is the right input or not. It seems to think everything is good and displays status.text = Congratulations no matter what I input.

I don’t have any idea how to fix this and would appreciate any help I can get. I can provide more information if needed. Thanks in advance!

Answer 1

From the code you posted, I want to make few things clear for you and then will suggest how to proceed. There are 4 main sqlite functions used to perform a database operation

1. sqlite3_open : To open a database connection
2. sqlite3_prepare_v2: To compile the query into byte-code program
3. sqlite_bind : To pass input values to the query
4. sqlite3_step : To evaluate/execute the compiled statement.

So from the code you posted above,

1. you have not performed step 4. So its obvious that you have not executed the query at all.
2. you formed the query completely(including the input parameter) using NSString stringWithFormat method, so there is no need to use sqlite_bind function.
3. The logic you used to authenticate user is also a bit confusing.

Here is the way to achieve what you need

if (sqlite3_open([dbPath UTF8String], &database) == SQLITE_OK) {
   const char *sql = "select * from User where id = ? and password = ?";
   sqlite3_stmt *selectstmt;
   if(sqlite3_prepare_v2(database, sql, -1, &selectstmt, NULL) == SQLITE_OK) {
     sqlite3_bind_text(selectstmt, 1, [login.text UTF8String], -1, SQLITE_TRANSIENT);
     sqlite3_bind_text(selectstmt, 2, [password.text UTF8String], -1, SQLITE_TRANSIENT);
      while(sqlite3_step(selectstmt) == SQLITE_ROW) {

          NSLog(@"Successful login");
      }
   }
 }