Cannot check hashed password

[bob2cam]

Hello,

When users enter their email address and password in the login form, a login
check is made using the following code. (The password is hashed in the database)

<!--- Find record with this Email/password --->
<cfquery name="getUser" datasource="security">
SELECT email, password
FROM users
WHERE email = '#FORM.email#' AND password = '#form.password#'
</cfquery>

<cfoutput>
<cfif Hash(Form.password, "SHA") is not getUser.password>
Not working
<cfelse>
OK, it works.
</cfif>
</cfoutput>

I cannot get it to return "OK , it works" for the life of me. Can anyone point
out what's incorrect?

Many thanks,
Bob

[TA-Selene]

Because the password field in your database is hased and the form field you are
passing into the getUser query is not, that query will return 0 results.

You have two options:

- Have your WHERE clauase contain only the email address and not the password
and then do your compare with the CFIF statement
- Create a variable that is a hash of the form password and use that in your
query WHERE clause, then change your conditional statement to see if
getUser.RecordCount is 0

[mkane1]

Selene is correct, you need to hash form.password before using it as a query
criteria. Or don't include the password as criteria but compare it afterwards,
but I don't see any advantage to doing that. I use hashed passwords in a lot of
apps, and do something like below.



<cfset HashedPW = Hash(form.password)>

<cfquery name="getUser" datasource="security">
SELECT email, password
FROM users
WHERE email = '#FORM.email#' AND password = '#HashedPW#'
</cfquery>

[bob2cam]

Thank you both. It works great!

Bob