Logging in from an external script using moodle database

Question

I'm not trying to create a plugin for moodle, I'm simply creating an external script that checks the credentials a user enters into a form against the user table in a moodle database.

Right now in the script, it the username matches, but the password doesn't. I've read some information about moodle using salting, but I'm still not getting any luck.

I'm using something like this to check the password.

$salt = 'random string of chars found in config file';
$password = md5($_POST['password'].$salt);
$query = "SELECT * FROM `user` WHERE password = '$password';";
...

Any suggestions would be greatly appreciated.

Could you try to log in your database and run this command? select * from user where password=MD5('your-passwordsalt'); and see what happens? Are you sure the column name is user and not mdl_user? — franzlorenzon
– franzlorenzon, Commented Jan 29, 2013 at 14:16

Jitendra Gaur · Accepted Answer · 2013-01-29 18:00:54Z

I have tested the code its working fine for me there are some possibilities maybe which you are doing wrong -

Make sure $salt string is same as in config.php($CFG->passwordsaltmain) file.
Make sure password is not directly reset from mysql database without moodle code.
Missing table prefix in your query.

My code -

<?php
    if ($_POST['submit']) {

        //your host detail
        $link = mysql_connect('localhost', 'root', 'root') or die(mysql_error());

        //your dbname
        mysql_select_db('moodle_23') or die(mysql_error()); 

        $salt = 'MG.b.;w>0B)3c.^:OqDd#?^h'; //change with your salt
        $password = md5($_POST['password'] . $salt);

        $query = "SELECT * FROM mdl_user WHERE username = '{$_POST['username']}' AND password = '$password'";

        $result = mysql_query($query) or die(mysql_error());

        echo '<pre>';

        while ($row = mysql_fetch_assoc($result)) {
            print_r($row);
        }
    }
    ?>
    <form action='' method="post">
        <p>Username = <input type="text" name ="username"/></p>
        <p>Password = <input type="password" name ="password"/></p>
        <input type="submit" value="submit" name="submit"/>
    </form>

Thanks

iankit · Accepted Answer · 2014-11-08 15:08:50Z

1

You should use moodle's Authentication API and its associated functions. auth_user_login ($username, $password)

Returns : true if the username and password work and false if they don't.

answered Nov 8, 2014 at 15:08

iankit

9,44210 gold badges53 silver badges57 bronze badges

Collectives™ on Stack Overflow

Logging in from an external script using moodle database

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related