Codeigniter: validation problem

Question

For some reason a user can login with any password, first I thought I forgot to check for the password but I didn't... and I just cant find the problem

here is the model:

/*#######################################################*/
    function validate()
/*#######################################################*/
    {
        $this->db->where('username', $this->input->post('username'));
        $this->db->where('password', md5($this->input->post('password')));
        $q = $this->db->get('user_extra');

        if($q->num_rows() == 1):
            return true;
        else:
            return false;
        endif;
    }//end of function validate()

The controller

/*#######################################################*/
        function validate_credentials()
/*#######################################################*/
        {
            $this->load->model('membership_model');

            $this->load->library('form_validation');

            $this->form_validation->set_rules('username', 'Name', 'trim|required');
            $this->form_validation->set_rules('password', 'password', 'trim|required');
            if(!$this->membership_model->validate()):
                $this->form_validation->set_message('check_login', 'Login not correct, please try again.');
            endif;

            if($this->form_validation->run() == FALSE):
                $this->index();
            else:
                $this->membership_model->userinfo($this->input->post('username'));
                //should redirect to last view
                redirect($this->session->flashdata('redirect_url'));
            endif;
        }// end of validate_credentials()

Answer 1

why dont you create a callback function in the validation string?

Put this function within the same controller

/*##############PRIVATE FUNCTION WITHIN THE SAME CONTROLLER###########*/
    function validate($username,$password) //if you use php 5 i would set this method to  private one
/*#######################################################*/
    {
        $this->db->where('username', $username);
        $this->db->where('password', md5($password));
        $q = $this->db->get('user_extra');

        if($q->num_rows() <= 1)
            return true;
        return false;

    }//end of function validate()

And the rule line:

$this->form_validation->set_rules('username', 'Name', 'trim|required|callback_validaion[password]');

Answer 2

Why not just use a caalback as part of the form validation?

e.g.

$this->form_validation->set_rules('password', 'Password', 'prep_for_form|required|xss_clean|callback_password_check');

and the callback function ...

function password_check($value) { /* call model and query database to get password */   if ($value == $password_from_model))    {       return TRUE;    }   else    {       $this->form_validation->set_message('password_check', 'You have not used the correct %s.');         return FALSE;   } }

Answer 3

I tried with callback function but it doesn't work for some reason so I just moved the if-statement below in the else-statement of the validation->run(), this is the code:

$this->form_validation->set_rules('username', 'Name', 'trim|required|xss_clean');
            $this->form_validation->set_rules('password', 'password', 'trim|required|xss_clean');


            if($this->form_validation->run() == FALSE):
                redirect(base_url().'login/index/error');
            else:       
                if($this->membership_model->validate()):
                    $this->membership_model->userinfo($this->input->post('username'));
                    //should redirect to last view
                    redirect('home/index');
                else:
                    redirect(base_url().'login/index/error');
                endif;
            endif;