SQL 'User' & 'Pass' Query.
lazarus / 16-Databases

----------------------------------------------------------------------
Kizbits2000 · 2010-07-26 22:30

I have been developing a little game in Pascal, and I hope to use a
User-name & Password system to log-on. I have set up a SQL Database,
It has all of the tables set up with the passwords set, But I am
awfull with SQL, I don't code it, I was just wandering if anyone can
supply the code that I would use to simply check my database against
the User-name & Password the user has entered into 'Edit' Boxes....

I have already set up the connection using the 'TMySQL50Connection',
All the need to do now is query it and send back a result when the
user enters the; user-name; password and then clicks the 'log-on'
button ('BitBtn2').

So I need it to find their username in the database, Read the Password
that is connected to that username, and then send back True or False;

True = The Password entered is the same one registered to their user-
name.
False = The Password entered doesn't match the one registered to their
user-name.

Edit: It doesn't have to send back true or false, it can just send
back the password connected to that account (As a Var) and then I can
code a way to compare it to the Password entered.

Sorry if I am being a pest.

Thanks

Kiz

----------------------------------------------------------------------
krexon · 2010-07-27 07:28

Isn't it too dangerous to send usernames and passwords from sql?
My method is:
Code: [Select]sqlquery.sql.text:='SELECT COUNT(username) AS username,
COUNT(password) AS password FROM users_table WHERE
username='+#39+editusername.text+#39+' AND
password='+#39+editpassword.text+#39';
sqlqery.open
if (SQLQuery.FieldByName('username').AsInteger=1) and
(SQLQuery.FieldByName('password').AsInteger=1) then .....

----------------------------------------------------------------------
Marc · 2010-07-27 12:48

Depends on your app, but in general it is not a good idea to store
passwords plaintext in a database.
What I usually do is store the MD5 hash of a password in the database.
On validating, hash the given password and and do a lookup on the user
+ hashed password

----------------------------------------------------------------------
JD · 2010-07-27 13:20

Quote from: Marc on July 27, 2010, 02:48:01 pmDepends on your app, but
in general it is not a good idea to store passwords plaintext in a
database.
What I usually do is store the MD5 hash of a password in the database.
On validating, hash the given password and and do a lookup on the user
+ hashed password

To limit the chances of success of a hacker using rainbow attacks to
retrieve the hashed passwords, it is better to hash a "salt" & the
password
Code: [Select]hash = md5(salt + password)
& do a lookup on the combination. This method dosen't mean the
database is foolproof. It just makes it a little more difficult for
hackers to crack.

----------------------------------------------------------------------
Kizbits2000 · 2010-07-28 23:05

Thank you very much for all of your replies.... They have been very
helpful!

Quote from: krexon on July 27, 2010, 09:28:21 amIsn't it too dangerous
to send usernames and passwords from sql?
My method is:
Code: [Select]sqlquery.sql.text:='SELECT COUNT(username) AS username,
COUNT(password) AS password FROM users_table WHERE
username='+#39+editusername.text+#39+' AND
password='+#39+editpassword.text+#39';
sqlqery.open
if (SQLQuery.FieldByName('username').AsInteger=1) and
(SQLQuery.FieldByName('password').AsInteger=1) then .....
I have used this with a TSQLQuery... But I do not understand what to
use as the transaction??? =S Very Confused... I have tried google...
But to no avail...
But thank you very much, Hopefully once I fully understand the code
you've supplied I will be able to work out the code for the rest of my
game... =)

Quote from: Marc on July 27, 2010, 02:48:01 pmDepends on your app, but
in general it is not a good idea to store passwords plaintext in a
database.
What I usually do is store the MD5 hash of a password in the database.
On validating, hash the given password and and do a lookup on the user
+ hashed password


Very good point... I will be adding MD5 to the Game after I have
finished it and released it as a Beta. But I don't know how to
generate a Password to a MD5 hash.

Thanks for all of your replies all =)

Kiz