Perl/DBI username searching problem

[dreamstreet]

Hello,

I'm trying to check if the username and password that is entered through the URL query by the user is correct. Now the URL goes : login.cgi?username=$username&pass=$pass&step=pg1

When I move on to the 'pg1' subroutine, I want to make sure if the entered username/password is correct. So I did the following but it doesn't seem to work:

sub pg1 {
&check_username;

print 'blah...
}


sub check_username {

$sql = <<EOF;
select * from members
EOF

my $sth = $dbh->prepare("$sql") or print "SQL ERROR";
$sth->execute();
while (@row = $sth->fetchrow() ) {

if (param('username') eq "$row[1]" && param('pass') eq "$row[2]") {
$id=$row[0];
$username=$row[1];
$pass=$row[2];
$email=$row[3];

}
print "Invalid Username/Pass";
exit;
}

ANy idea? Thanks for reading. I appreciate it.
}

 

[PaulTEG]

First off, its insecure to pass username and password information in a GET request, you should use POST
try this

print "User:".param('username')."=>".$row[1];
print "Pass:".param('pass')."=>".$row[2];
if ((param('username') eq "$row[1]") &&  (param('pass') eq "$row[2]")) {

Note the extra braces on the if statement
HTH
--Paul

cigless ...

 

[dreamstreet]

Paul, that was beautiful Happy Easter