I have a simple program to check if an email and hashed password are in a Postgres database (It's meant to be a cgi app, but because it fails, I'm testing it as a script first):
import cgi
import cgitb
import hashlib
import psycopg2
from dbconfig import *
cgitb.enable()
print "Content-Type: text/plain\n\n";
def checkPass():
email = "person@gmail.com"
password = "mypassword"
password = hashlib.sha224(password.encode()).hexdigest()
result = cursor.execute('SELECT * FROM logins WHERE email=%s AND passhash=%s', (email, password))
print result
if __name__ == "__main__":
conn_string = "host=%s dbname=%s user=%s password=%s" % (host, database, dbuser, dbpassword)
conn = psycopg2.connect(conn_string)
cursor = conn.cursor()
checkPass()
This program always returns None on the print. The email and hashed password are definitely in the database though. I put them there with this:
email = "person@gmail.com"
allpass = "mypassword"
password = hashlib.sha224(allpass.encode()).hexdigest()
cursor.execute('INSERT INTO logins (email, passhash) VALUES (%s, %s);', (email, password))
conn.commit()
And checking the db shows there's that email and hashed password. So why doesn't the first program return something upon the SELECT statement? Are hashes not stored in the same way? Any help would be greatly appreciated.
I worked out what was wrong. As it happens, cursor.execute() doesn't actually return anything. You have to use fetchone() for that.
cursor.execute('SELECT * FROM logins WHERE email=%s AND passhash=%s;', (email, password))
result = cursor.fetchone()
print result
This prints a tuple of the correct results.