Question

I use the method defined in django documentaion:http://www.djangobook.com/en/beta/chapter12/

def login(request):
    m = members.get_object(username__exact=request.POST['username'])
    if m.password == request.POST['password']:
        request.session['member_id'] = m.id
        return HttpResponse("You're logged in.")
    else:
        return HttpResponse("Your username and password didn't match.")

but that sounds like it doesn’t match the password correctly! I enter a valid username and password but it doesn’t find the user,when I remove this line,it works:

if m.password == request.POST['password']:

I think because that password is hashed,it doesn’t match with plain password that user enter in login form.

so,what should I do now?

Answer 1

You should use user.check_password for this. The reason is that the password is stored hashed and you can not compare it directly like this.

P.S. Take a loot at how authentication backends work.