Login validation algorithms

Question

I know of one -

SELECT * FROM log_records WHERE 'username'=uname AND 'password'=pass;
if(row_count==1)
    return true;
return false;

The questions are:

Is the above algorithm a 'best practice'?
Are there any alternatives to the above algorithm?

Thanks!

By the way, what platform are you developing in? You might get more specific guidance if you tag the questions with your environment, as many platforms already offer authentication/membership mechanisms. Most of your questions seem to deal with PHP... Is it safe to assume you're looking for guidance specific to PHP? — David, Apr 15 '11 at 13:46
Yes, I am indeed using PHP. Nevertheless, general guidelines are also welcome. — check123, Apr 15 '11 at 14:36
In that case, I would refer you to here: http://stackoverflow.com/questions/1624846/php-best-practices-for-user-authentication-and-password-security — David, Apr 15 '11 at 15:17

David · Accepted Answer · 2011-04-15T16:30:22.937

That is NOT a best practice.

First, it would only work if the username and password were unencrypted.
Second it's hopelessly vulnberable to SQL Injection and I could steal all of your user credentials in about 3 seconds with that SQL statement.

Start here for best practices: https://www.owasp.org/index.php/Guide_to_Authentication

Your best bet is to use an existing membership provider for whatever environment you're developing in, rather than building your own, or better yet, using OpenID or a similar mehanism.

Even if the OWASP article is too in depth, PLEASE at least read this: http://www.codinghorror.com/blog/2008/05/openid-does-the-world-really-need-yet-another-username-and-password.html

and this: http://www.codinghorror.com/blog/2007/09/youre-probably-storing-passwords-incorrectly.html

One last edit

This is the article I was REALLY looking for when I found those two above: http://www.codinghorror.com/blog/2010/12/the-dirty-truth-about-web-passwords.html

But I am making this for a B2B web-application (as SAAS model) and I therefore need to employ my own login management. — check123, Apr 15 '11 at 14:34
There are several PHO-specific answers here: http://stackoverflow.com/questions/1624846/php-best-practices-for-user-authentication-and-password-security — David, Apr 15 '11 at 15:18

score 0 · Answer 2 · answered Apr 15 '11 at 13:42

You could do this...

SELECT `id`, `password` FROM `log_records` WHERE `username` = uname

Assuming of course that uname is binded or escaped through the correct escaping mechanism.

If no rows, you would know the user does not exist.

You could then compare the user submitted password to the password for this user.

You could then internally log the specifics of this failed login.

Remember, don't tell the end user which failed. Use something generic such as The username and/or password combination does not match.

score 0 · Answer 3 · answered Apr 15 '11 at 13:42

0

That is a valid way of doing it. It's not included in your post, but I asume that pass is a encrypted version of the actual password?

The above statement does require the username to be unique, but it usually is.

A side note is that the above statement doesnt have to be case-sensitive. Some database compare textual data in text format instead of bit format. This would mean that logging in with password 'MyPasSworD' would work, but 'mypassword' would work aswell.

answered Apr 15 '11 at 13:42

Hugo Delsing

13,803
5
45
72

Yes the password is encrypted. As for the case sensitive thing, I feel its better to keep to the naming conventions/standards even if technology allows leeway. :) – check123 Apr 15 '11 at 14:38

score -1 · Answer 4 · answered Jun 18 '16 at 02:19

-1

i'm using this pseudo code algo.

start
- sanitize inputs
- check username if exist
- get username's password if exist
- if using an enryption, encrypt the entered password
- compare username's password to the the entered password
- do some stuff
end

answered Jun 18 '16 at 02:19

Regs Isabelo Jr.

29
3

Login validation algorithms

4 Answers4