using where clause in codeigniter issue

Question

I am loggin in user. So after entring email and password by user then I want to check whether user with that email and password exist. For this reason I am using where clause twice but somehow it is not working. Perhaps because I am using it incorrectly. How can I fix my below code

$this->db->where('email', $this->input->post('email'));
$this->db->where('password', $pass . $salt);

Answer 1

The where is working fine, it's the second where that is wrong, you're passing the password + the salt but you aren't encoding anything, just concatenating them. So if your password is bob and your salt is pepper you're passing bobpepper as the password field to the query.

Depending on the encryption your code should look similar to this:

 $password = md5($this->input->post('password'). $salt);  //swap the md5 for whatever encryption method you're using.
 $this->db->where('email', $this->input->post('email'));
 $this->db->where('password', $password);

Answer 2

You don't need to do your where clause twice.

public function login(){

    try
    {
        $user = $this->db->select()->where()->get(); // mysql query

        if( !$user)
            throw new Exception("User not found!");

        if( !$this->compare_password($this->input->post('password'), $user->password ) )
            throw new Exception("Passwords did not match!");
    }
    catch(Exception $e) 
    {
        $this->session->set_flashdata('error', $e->getMessage());
        log_message('error', $e->getMessage()); 
        redirect('/');
    }

    //we got this far so everything should be OK

    $this->session->set_flashdata('success', 'Login Successfull');
    redirect('dashboard');
}

Note: You would want to use a better password hashing algorithim than this in production mode!!

protected function hash_password($password){
    return sha1( $pw . $this->config->item('encryption_key') );
}

protected function compare_password($pw, $dbpw){
    return ( sha1($pw . $this->config->item('encryption_key') ) === $dbpw )
}