<%args> $login_name $password <%once> use DBI; use Crypt::PasswdMD5; <%init> my $dbh = DBI->connect('dbi:Pg:dbname=pua', 'pua', 'pua') or die "Couldn't connect to database: " . DBI->errstr; my $sth = $dbh->prepare("SELECT pua_id,password_hash from pua where username='$login_name';"); $sth->execute or die "Execute failed: " . $sth->errstr; my ($pua_id,$password_hash) = $sth->fetchrow_array(); if ($pua_id) { die("invalid password in database for user $login_name") unless $password_hash =~ / ^ \$ 1 \$ ( [^\$]+ ) \$ /x; my $salt = $1; if(unix_md5_crypt($password, $salt) eq $password_hash) { $m->comp('intro.html', pua_id => $pua_id); } else { $m->comp('index.html', msg => "Invalid password"); } } else { $m->comp('index.html', msg => "Invalid username"); }