login function using sqlite in python

Question

I'm writing a python script that allows for sign up and log in, the signup works fine, but the login and authentication doesn't work even if the user is registered.

def userlogin(self, ID, password):
        try:
            statement = conn.execute('SELECT ID FROM USERS')
            conn.commit()
            for row in statement:
                if ID in statement:
                    print "%d" % ID
                    pas = conn.execute('SELECT PASSWORD FROM USERS WHERE ID = %d' % (ID))
                    conn.commit()
                    if password in pas:
                        print "welcome user %d" % ID
                        conn.close()
                    else:
                        print "username/password incorrect!"
                        conn.close()
                else:
                    print "Incorrect ID! If you are not a user, please register here."
        except IOError:
                print "Select statement could not execute!"

I know this is not the best way to write this function, I'm doing it for practice. Even if the password and ID are entered correctly, it always prints Incorrect ID. Is there anything wrong with the if statement?

What do you mean "doesn't work"? Please show the results and what you expect — cadrian
– cadrian, Commented Nov 30, 2015 at 16:17
Don't use string formatting on query strings; it's dangerous! Use SQL parameters! pas = conn.execute("SELECT password FROM users WHERE ID = ?", (ID,)) — Colonel Thirty Two
– Colonel Thirty Two, Commented Nov 30, 2015 at 16:28

cadrian · Accepted Answer · 2015-11-30 16:18:08Z

1

The problems I see at first glance: (there may be more)

No need for commit statements since you only read data
Your first select statement should filter on something; a user name perhaps?
You close the connexion in the middle of the loop, so event if you find the right user you may have an exception
Bonus: are your passwords in clear text?? (not so important since you say it is only practice; but it is good practice to encrypt passwords anyway)

answered Nov 30, 2015 at 16:18

cadrian

7,3982 gold badges36 silver badges42 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Fujiao Liu · Accepted Answer · 2015-12-01 02:05:44Z

for your code, it should be if ID in row rather than if ID in statement and your need break the for loop if a user is valid.

def userlogin(self, ID, password):
        try:
            statement = conn.execute('SELECT ID FROM USERS')

            for row in statement:
                if ID in row:  # compare one by one
                    print "%d" % ID
                    pas = conn.execute('SELECT PASSWORD FROM USERS WHERE ID = %d' % (ID))

                    if password in pas:
                        print "welcome user %d" % ID

                    else:
                        print "password incorrect!" # ID is matched
                    conn.close()
                    return 
            print "Incorrect ID! If you are not a user, please register here."
        except IOError:
                print "Select statement could not execute!"
        finally:
                conn.close()

Yash Mehrotra · Accepted Answer · 2015-11-30 16:23:37Z

0

Instead of so many checks, you can just use a query like

SELECT COUNT(*) FROM USERS WHERE PASSWORD = %s AND ID=%d

Now if the count is 0 then the password/id combo is wrong, else, if the count is non-zero, the password/id combination is correct.

answered Nov 30, 2015 at 16:23

Yash Mehrotra

3,1601 gold badge23 silver badges24 bronze badges

Collectives™ on Stack Overflow

login function using sqlite in python

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related