- returns data from a free form select query
| public query ( string $query, array $params = [], boolean $use_master = false ) : mixed | ||
| $query | string | - the SQL query we are executing |
| $params | array | - a list of bind parameters |
| $use_master | boolean | (Optional) - whether or not to use the master connection |
| return | mixed | - the affected rows, false on failure |
/**
* Static method for creating PDOWrapper object with MYSQL connection
*
* @param string $host Mysql host
* @param string $dbName Mysql database name
* @param string $username Mysql user name
* @param string $password Mysql password
* @param string $charset Connection charset
* @return PDOWrapper
*/
public static function openMysql($host, $dbName, $username, $password, $charset = "")
{
$wrapper = new PDOWrapper("mysql:host={$host};dbname={$dbName}", $username, $password);
if ($charset && !$wrapper->getLastError()) {
$wrapper->query("SET NAMES ?", array($charset));
}
return $wrapper;
}
/**
* Checks username and password against "users" table
*
* @param string $username user login for check
* @param string $password password
* @return bool true when login+password match stored data, false elsewhere
*/
private function checkPassword($login, $password)
{
$DB = new PDOWrapper($this->CONFIG['database']['server_driver'], $this->CONFIG['database']['server_host'], $this->CONFIG['database']['server_login'], $this->CONFIG['database']['server_password'], $this->CONFIG['database']['server_db_name']);
if (!preg_match(self::REGEXP_USERNAME, $login)) {
return false;
}
// if field specified for "secret", use its value, constant else
$secret_field = isset($this->CONFIG['secret_field']) && $this->CONFIG['secret_field'] > '' ? '`' . $this->CONFIG['secret_field'] . '`' : '\'' . $this->CONFIG['secret_default'] . '\'';
try {
// note that "{$secret_field}" is not wrapped with braces as it can contain either field name or direct string
$query = $DB->query("select `{$this->CONFIG['md5_field']}`, {$secret_field} as secret from `{$this->CONFIG['table']}` where `{$this->CONFIG['login_field']}` = '{$login}'");
} catch (Exception $e) {
return false;
}
// if no data returned at all, no such user
if ($query === false || !($data = $query->fetch())) {
return false;
}
// get stored password hash
$saved_md5 = $data[$this->CONFIG['md5_field']];
// calculate test hash. note again that $data['secret'] contains either stored secret or some default value
$check_md5 = $this->generateHash($password, $data['secret']);
if ($saved_md5 != $check_md5) {
return false;
}
// all ok, get if out
return true;
}
