Question

I am working on an application that requires user to authenticate. I am doing this by having a database that has a profile table and has inside the table a username and password. I was going to have the user input their username and password and then compare their given data against the data in the database. And if they were the same, then they are logged in. Is this the correct way to do this?

If this is the correct way to do this, how do i compare the user’s given password to the password in the database? The password in the database was encrypted using the PASSWORD function.

Thanks!

Answer 1

You can use AES_ENCRYPT(), AES_DECRYPT() functions for this. Here the way I propose. In your program you keep a constant global variable which stored the encryption key.

So you can compare the password like this.

SELECT User_ID FROM profile where profile.userID= ‘ + userID + ‘ AND profile.password = AES_ENCRYPT(‘ + givenpassword + ‘,'” + USER_ENCRYPTION_KEY + “‘)

Hope this will help you.

Prasad.