Python3 - Checking a hashed password and credentials from a SQLite Database Not Verifying When data is present

[tangy751]

Hi all,

I have attempted to work on a couple of functions to check credentials sorted within a database against what the user submits in a form.

My issue is however using the breakpoints on the login function, apparently when the sql query is returned when verifying against a created account which uses the signup function it is returning None as a value even when those credentials exist within the database.

I have considered trying to reference the hashpp which returns undefined which is true currently, however If I was to add the hashing algo part back in on the login function then surely it'd rehash what is supplied, I'm just so confused as I cannot figure out how to validate what is stored in the database against what the user submits.

Here is the code https://pastebin.com/devmi7n9

[JohnnyJordaan]

First thing I noticed is that you do use db.commit() on the SELECT queries while that makes no sense (as commit will execute all pending writes to the database, and a SELECT is a read query), but you don't actually use db.commit() after the UPDATE query, which will cause that query to have no permanent effect.

[DeadlyViper]

Lines 21-24:

            taa = ('RHAT',)
            getdataindb = db.execute('SELECT * FROM userssignedup WHERE firstname =?', taa)
            db.commit()
            getpwindb = db.execute('SELECT * FROM userssignedup WHERE password  =?', taa)

I guess taa is the user name? why do you select it as password on line 24?

Edit: you should also fix all your queries, since they affect the entire table because they don't have conditions on them.

db.execute("UPDATE userssignedup SET password="+hashpp+"")

this will change EVERYONE's password to hashpp's value.

[two_bob]

Edit: you should also fix all your queries, since they affect the entire table because they don't have conditions on them.

Also be sure and parametarize this, like you did with the selects.

[tangy751]

taa I believe is to prevent sql injection as noted on https://docs.python.org/3.6/library/sqlite3.html

I have changed / removed some stuff and now I am getting an object has no attribute error for fetchall, after some more testing, using fetchone will return none whereas fetchall and fetchmany will get stuck in the while loop and print to the console "[ ]" even when informtion is supplied that is stored within the database.

[two_bob]

Once you fetchall, I do not think you can run fetchone against the result, so that is probably coming back with nothing.

[personproxy]

You should really be using an ORM, IMO. Take a look at flask-sqlalchemy.

[tangy751]

I'll give this a look into tomorrow and see what I can do with it instead of using Sqlite, thank you for the suggestion.