Password encoded variable in query

[chancho]

I have the following query initiated by a php script that checks the login and password inputs off a form:

$a_query = "SELECT * FROM ismembercmp WHERE member_name = '$cl_name' AND PASSWORD( pswrd = '$cl_pswrd' )";

The problem is that no matter what $cl_pswrd is, the query returns a match. Anybody know why, or how I can fix this problem? Thanks.

[[deleted]]

This makes no sense:

AND PASSWORD( pswrd = '$cl_pswrd' )";

What you want to do is compare the password you received with the password stored in the database:

AND pswrd=PASSWORD('$cl_pswrd')";

[chancho]

Thank you Vincent.

[chancho]

When I changed: AND PASSWORD( pswrd = '$cl_pswrd' )";

to

AND pswrd=PASSWORD('$cl_pswrd')";

does not return a match. Any idea why???

[[deleted]]

Maybe because there are no records where pswrd contains the encrypted password?

try something like this:

SELECT PASSWORD('$cl_pswrd'), pswrd
FROM your_table;

and see what your query is comparing.