views:

2232

answers:

6

I am using mysql and php. In my database I have this table called users, inside users table have a record:

username: admin

password: password

In my login page, I tried login as (password: password):

  • username : ADMIN -> result : can login
  • username : admin -> result : can login

I store the username in my database as "admin" all lowercase

In my php authentication page, I didnt include the strtolower() function. Does it mean, in php the username form field that I submitted is not case sensitive??

+8  A: 

It's not PHP. It's your database query that is not case sensitive.

You can either make one of the operands binary string. For example:

SELECT 'abc' LIKE 'ABC';

This will return 1 or true. While

SELECT 'abc' LIKE BINARY 'ABC';

will return 0 or false.

Randell
Yes, MySQL is not case sensitive by default.
TheJacobTaylor
Huh?? Can explain more? My current script: SELECT * FROM users WHERE username ='" . mysql_real_escape_string($_POST['username']) . "'";
How to make it sensitve??
>> How to make it sensitve?? << check my post
Narayan
@Narayan: Cant find your post
@Narayan: Opps, sory, I found it alreay. Its on one of the answers of this question
Don’t use `LIKE`, use a simple comparison instead.
Gumbo
@Gumbo: do you mean something like this: SELECT ... 'abc' = 'ABC'
A: 

How should it know it's the username form field?

If I remember right, in *nix a username was case-insensitive. Are you using a library to store the userinformation and to compare it?

StampedeXV
i submit the username in 2 versions, 1 in all uppercase, 1 in all lowercase, both can login. No, i didnt use any library, just a simple login form I created by myself
A: 
When you are login,

I think you should write query  to validate user name and password are the same in the table

you have been saved.
thinzar
My table stored the username as "admin" (all lowercase), thats mean, in php, i need to use strtolower() to convert all the string to lowercase. Is that what you mean? Based on Randell's answer, its case-insensitive, so why should I use the strtolower() again? What are the causes if I dont use the strtolower() function? Can you elaborate more please?
Your answer has been voted down, does it mean I dont need to convert the string to lowercase?
Please don't use code formatting when you write text.
kbok
+3  A: 

yup as Randell said, its the database that is Case-Sensitive, Check this article, for "Can we make MySQL to be case sensitive for SELECT queries and can we force a column in MySQL to be always lowercase?"

Narayan
typo error "its the databse that is Case-Sensitive"??
+1  A: 

I think have some way to go before it's clear...

MySQL is NOT case sensitive for queries. SELECT and select mean the same thing.

The data in the tables is stored as is, but since you can only get information out with queries, you need to phrase them carefully.

As Randell said

select 'abc' like 'ABC'

Will return TRUE (so will SELECT 'abc' like 'ABC') because LIKE ignores case differences

select 'abc' like binary 'ABC'

will return FALSE (and so will SELECT 'abc' LIKE BINARY 'ABC') because LIKE BINARY looks more carefully. There IS a difference at the binary level.

pavium
A: 

thnks a lot finally I got it

ajay