or_where problem

[eluser]ibnclaudius[/eluser]
This way, if the user enter the correct username and a wrong password, return TRUE:

Code:

$query = $this->db->where('username', $identifier)
        ->or_where('email', $identifier)
        ->where('password', $password)
        ->count_all_results($this->_table['users']);

  if ($query === 1) return TRUE;
  
  return FALSE;

And, this way, if the user enter the correct email and a wrong password, return TRUE:

Code:

$query = $this->db->where('email', $identifier)
        ->or_where('username', $identifier)
        ->where('password', $password)
        ->count_all_results($this->_table['users']);

  if ($query === 1) return TRUE;
  
  return FALSE;

I don`t see nothing wrong on the logic. I want to make possible for the user login by his email or username...

[eluser]weboap[/eluser]
what is the question?

[eluser]ibnclaudius[/eluser]
Why the user can login even with a wrong password? I want to make possible login with username or email. Read again my first post. Thanks.

[eluser]Sanjay Sarvaiya[/eluser]
Try this

Code:

$where = "password = '" . $password . "' AND (email = '". $identifier ."' OR username = '" . $identifier . "')";
    $query = $this->db->where($where)
        ->count_all_results($this->_table['users']);

[eluser]weboap[/eluser]
can you move the

Code:

->where('password', $password)

UP to be the 1st where and leave or_where last and try.

post back result.

[eluser]weboap[/eluser]
@sanjay response will work too.
here is what's happening check this article

http://www.atomni.com/code-igniter-activ...d-or_where

[eluser]Sanjay Sarvaiya[/eluser]
@weboap thnx, That is great and helpful article.

[eluser]neilmcgann[/eluser]
[quote author="Sanjay Sarvaiya" date="1337403623"]Try this

Code:

$where = "password = '" . $password . "' AND (email = '". $identifier ."' OR username = '" . $identifier . "')";
    $query = $this->db->where($where)
        ->count_all_results($this->_table['users']);

[/quote]
Sql injection alert!

Use $this->db->escape($password) etc. when dynamically building a query like this.

(or change it to use a parameterised query)