Password Validation

Question

Using mysql and php

Is there any reason / value when checking a password to query the database using the user name and password (after sanitizing, of course) and recording a failed attempt when no rows are returned vs querying the database using the user name and then comparing the return password string?

EDIT: To those who mentioned it below, yes the password is hashed up in the database.

Answer 1

If I'm understanding you correctly, you're wondering if there's a difference between comparing the results of:

$results = mysql_query("SELECT name FROM users WHERE name = $properlyEscapedName AND pass = $properlyEscapedPassword");
if (mysql_num_rows($result) == 1)
    $authenticated = true;

versus

$results = mysql_query("SELECT name, pass FROM users WHERE name = $properlyEscapedName");
$array = mysql_fetch_assoc($results);
if ($array["pass"] == $unescapedPass)
    $authenticated = true;

I would note that it's better to store password hashes than plaintext passwords for security reasons, but otherwise the only difference I see is that in the first case you will return one less field, which may mean more efficient use of bandwidth between your server and the database. On the other hand, your query is several bytes larger, so that probably mitigates the small benefit of the smaller result set.