Comparing same string where one is from Flask and one from a sqlite3 database

Question

In a login authentication module for a webapp, I'm trying to compare two values; a user entered password, and a password hash that is stored in a sqlite3 database (the hash just being the string 'password' for now). The code is as follows:

@app.route("/login", methods=["GET", "POST"])
def login():
    if request.method == "POST":
        if request.form['login'] == 'Login':
            username = request.form['username']
            user_password = request.form['password']
            #print query_db("SELECT * FROM Users WHERE Username=?", username, one=True)[0]
            try:
                user = User(query_db("SELECT * FROM Users WHERE Username=?", username, one=True)[0])
                print user.hash

            except IndexError:
                return "INVALID USERNAME!"
            hash = User.hash
            print hash
            #print whatisthis(hash)
            print user_password
            #print whatisthis(user_password)
            if user_password == hash:
                print "wooo!"
                #login_user(user)
                #flash("Logged in successfully.")
                return "LOGIN SUCCESS!"
                #return redirect(request.args.get("next") or url_for("index"))
            else:
                return "INVALID PASSWORD!"
    return render_template("login.html")

User is a class that gets its attributes (like .hash) from the database after accessing the database through the ID. The print statements are simply for debugging, and they do show correctly the two strings ( hash or User.hash , and user_password ) to be identical when printing them to the terminal. However, they do not evaluate True in the if user_password == hash statement for some reason, always defaulting to the else case. Additionally, if I try to perform .encode('base64') on both strings, user_password properly changes to base64, however hash or User.hash stays the same even after the .encode!

Thanks a lot for your help with this odd problem!

Answer 1

User hash = user.hash rather than hash = User.hash .

>>> class User:
...     hash = ""
...     def __init__(self, hash):
...             self.hash = hash
...
>>> u1 = User("hash1")
>>> User.hash
''
>>> u1.hash
'hash1'

If you didn't set User.hash somewhere else in your code, User.hash will still has default value which is '' . Therefore, since your User.hash is "password" , it is very likely to be set by other code.