Question

I have a user password system where I need to 1) check a user password against two potential passwords stored in the database and 2) if a match is found make sure the user email matches the user email stored in the row that had the matching password.

This the current mysql I have to pull the unique user on login:

$sql = "SELECT * FROM users WHERE email='$u' AND password='$p' OR password_two='$p'";

This works in the vast majority of cases but fails when multiple users have the same passwords – for example if multiple users have the password ‘123456’. I’m assuming this is because the AND OR setup I have above is incorrect.

I’m updated the sql query to the statement below:

$sql = "SELECT * FROM (SELECT * FROM users WHERE password='$p' OR password_two='$p') WHERE email = '$u' ";

This query doesn’t work for any users – Can someone help me identify where the query is going wrong?

Answer 1

If I understand the question correctly, you’re looking for:

$sql = "SELECT * FROM users WHERE email='$u' AND (password='$p' OR password_two='$p')";

Without the parenthesis, it’s interpreted as:

$sql = "SELECT * FROM users WHERE (email='$u' AND password='$p') OR (password_two='$p')";