CODEWITHSUNDEEP
codeigniteractiverecordcodeigniter-2
Leandro Garcia
Leandro Garcia

Reputation: 3228

codeigniter active record where, or_where?

I am using Active Record on CodeIgniter. I am confused on which approach I should take. Currently, our login system let's the user to use username/email for the login along with the password. But my current active record, seems to let the user logged in if he choose to use the email + no password.

Right now this is my query:

$this->db->select('id,level,email,username');
$this->db->where('email',$user);
$this->db->or_where('username',$user);
$this->db->where('password',$pass);
$query = $this->db->get('users');

if($query->num_rows>0)
  return TRUE;
else
  return FALSE;

Sample inputs:

The fourth test input must be Failed in result, but it seems that it logs the user even if the password is empty.

Upvotes: 6

Views: 26263

Answers (3)

Amin
Amin

Reputation: 741

$conditions = '(`username`="'.$username.'" OR `email`="'.$email.' OR `mobile`="'.$mobile.'"') AND `password`="'.$password.'"';          
$query = $this->db->get_where('table_name', $conditions);
$result = $query->result();

Upvotes: 0

Tum
Tum

Reputation: 7585

@RidIculous is right. This is a correct way to do it:

$user = $this->db->escape($user);
$this->db->select('id,level,email,username');
$this->db->where("(email = $user OR username = $user)");
$this->db->where('password', $pass);
$query = $this->db->get('users');

Or a format I prefer (PHP 5+)

$user = $this->db->escape($user);
$query = $this->db
    ->select('id,level,email,username')
    ->where("(email = $user OR username = $user)")
    ->where('password', $pass)
    ->get('users');

Upvotes: 4

safarov
safarov

Reputation: 7804

The issue is probably that you need to add brackets when mixing AND’s and OR’s in a WHERE clause. Try this:

$this->db->select('id,level,email,username');
$this->db->where("(email = '$user' OR username = '$user') 
                   AND password = '$pass'");
$query = $this->db->get('users');

Upvotes: 18

Related Questions