user authentication

[Yosi Hendarsjah]

I have a user table that contains three columns: username, password, and fullname. The fullname will be used to greet the user. The password is hashed before put in the table. Which one is the better way:

Method 1:
The query is

select password, fullname from user where username = 'joe'

If the query doesn't return a row it means the username given is wrong.
If it does, then we compare the password we get from the database with the one given by user.

OR

Method 2:
The query is

select fullname from user where username = 'joe' and password = '123'

If the query doesn't return a row it means either the username or the password are wrong.

?
[ May 16, 2005: Message edited by: Yosi Hendarsjah ]

[Amarender Reddy]

yosi!

even though either of them will work, the second seems to be more effective as the username-pw combination needs to be matched

cheers

[Jeanne Boyarsky]

Yosi,
I agree that option 2 is better. There is less network traffic.

Even better is to use a PreparedStatement so the sql is only compiled once.

select fullname from user where username = ? and password = ?

[Yosi Hendarsjah]

Thanks Amarender and Jeanne!
Your opinion is the same as I thought. I even use the PreparedStatement.

yosi