Question

I’m writing a sign up script, the users password is encrypted like so

$pword = hash('sha512', $_POST['password']);

when the log in I use the same post script about to encrypt the password then look for a match in the database

$result = mysql_query("SELECT * FROM $table WHERE email = '$email' AND password = '$pword'
  ");
if(mysql_num_rows($result))
 {
//do something
$return['error'] = false;
$return['msg'] = 'Logging In.';
}

else
{
 // Invalid username/password
 $return['error'] = true;
  $return['msg'] = 'Wrong Email Or Password Try Again';
 }

The problem is I keep getting an error message, it’s like the password’s don’t match.

I changed it to this script

$query_wins ="SELECT * FROM `users` WHERE `email` = \"$email\" AND `password`=\"$pword\" AND `active`='Y'";
$result=mysql_query($query_wins) or die(mysql_error());
$result= mysql_query($query_wins);
$row = mysql_fetch_array($result);
$memid= $row['id'];

 if($memid==""){
$return['error'] = true;
$return['msg'] = 'Wrong Email Or Password Try Again';
}

And now it just giving me the “Wrong Email Or Password Error”

Answer 1

Things to check:

• are you hashing the password before saving it to the database?
• is your hashed password being truncated?
• are you hashing the password
  BEFORE checking the same password in the database?
• use
  if(mysql_num_rows($result) > 0) to see if you get a result