All geek questions in one place

Password Verification

Using mysql and php

Is there any reason / value when checking the password for querying the database using the username and password (after disinfection, of course) and recording an unsuccessful attempt when the rows are not returned and do not query the database using the username, and then comparing the string reset password?

EDIT: to those who mentioned this below, yes, the password in the block is hashed.

+3
source share
5 answers

If I understand you correctly, you are wondering if there is a difference between the comparison results:

$results = mysql_query("SELECT name FROM users WHERE name = $properlyEscapedName AND pass = $properlyEscapedPassword");
if (mysql_num_rows($result) == 1)
    $authenticated = true;

against

$results = mysql_query("SELECT name, pass FROM users WHERE name = $properlyEscapedName");
$array = mysql_fetch_assoc($results);
if ($array["pass"] == $unescapedPass)
    $authenticated = true;

, , , , , . , , , , .

+4

2 .

  • - . , . , ,
  • .
+1

, , .

, , , , . , , ( "Arkh01", "arkh" "Arkh1" ).

, , , . . -, , , "aa" , "ab" . , .

, , IP , 5- . IP-, .

hmac + sha512 php: hash_hmac

+1

. , .

0

/ , DOS. OTOH .

, cookie ( cookie , ), cookie - - , cookie ). , cookie, , , .

, .

.

0

Source: https://habr.com/ru/post/1738438/

More articles:


All Articles