Login Stored Procedure - SQL Server - sql

Question

I have a stored procedure for login. There are three parameters:
i) Email
ii) Password
iii) IsActive.
I want to check various aspects and return a bit value for each case.
I tried:
CREATE PROCEDURE [dbo].[SP_Login]
#Email VARCHAR(100),
#Password VARCHAR(50),
#ReturnValue INT
AS
BEGIN
-- No User
IF NOT EXISTS (Select * From AdminAccount Where Email=#Email and Password = #Password)
BEGIN
SET #ReturnValue = 0
END
-- Active User
ELSE IF EXISTS (Select * From AdminAccount Where Email=#Email and Password = #Password and IsActive='1')
BEGIN
SET #ReturnValue = 1
END
-- Not Active user
ELSE IF EXISTS (Select * From AdminAccount Where Email=#Email and Password = #Password and IsActive='0')
BEGIN
SET #ReturnValue = 2
END
-- Email Not Exist
ELSE IF NOT EXISTS (Select * From AdminAccount Where Email=#Email)
BEGIN
SET #ReturnValue = 3
END
-- Password Not Match
ELSE IF EXISTS (Select * From AdminAccount Where Email=#Email)
BEGIN
SET #ReturnValue = 4
END
END
Now the issue is it uses various SELECT Queries.
Is there any way to minimize or Optimize the code without losing meaning.

Answer 1

Try this
declare #AdminAccount table (Email varchar(100), Pass varchar(50), IsActive bit)
insert into #AdminAccount
values ('mail1#m.com', 'abc', 1), ('mail2#m.com', '123', 0)
--Testing values
declare #Email VARCHAR(100) = 'mail2#m.com',
#Password VARCHAR(50) = '123',
#ReturnValue tinyint
--Temporary table: It avoid us to query the table many times
declare #userData table (Email varchar(100), Pass VARCHAR(50), IsActive bit)
if exists ( select top 1 1 from #AdminAccount where Email = #Email )
insert into #userData
select Email, Pass, IsActive
from #AdminAccount
where Email = #Email
else
begin
if not exists ( select top 1 1 from #AdminAccount where Email = #Email and Pass = #Password )
set #ReturnValue = 0
else
set #ReturnValue = 3 --it will never return this value (3)
end
select #ReturnValue =
case
when #Email = Email and #Password = Pass and IsActive = 1 then 1
when #Email = Email and #Password = Pass and IsActive = 0 then 2
else 4
end
from #userData
select #ReturnValue as RV

Answer 2

Try this:
IF EXISTS (SELECT * FROM AdminAccount WHERE Email=#Email)
BEGIN
SELECT #ReturnValue =
CASE WHEN Password = #Password AND IsActive='1' THEN 1 -- Password match, Active User
WHEN Password = #Password AND IsActive='0' THEN 2 -- Password match, Inactive User
WHEN Password <> #Password AND IsActive='1' THEN 3 -- Active User, Password does not match
WHEN Password <> #Password AND IsActive='0' THEN 4 -- Inactive User, Password does not match
ELSE 0 -- Details (Email and Password) do not match
END
FROM AdminAccount WHERE Email=#Email
END
ELSE IF NOT EXISTS (SELECT * FROM AdminAccount WHERE Email=#Email)
BEGIN
SET #ReturnValue = 0
END

Answer 3

Since the question isn't about how to store passwords in a database, I will not be addressing that in this answer.
The first thing I must point out is that your procedure will never return the value 3. If the Email parameter does not match an account, your condition for returning 0 will always be met before the condition for returning 3 is evaluated. For that reason I've excluded it in this answer.
If your goal is to avoid multiple queries inside your stored procedure (a good idea), you can accomplish the same logic by using a single query and local variables. Here is a proof of concept using Microsoft SQL Server 2014.
CREATE TABLE AdminAccount (
Email VARCHAR(100),
Password VARCHAR(50),
IsActive BIT
)
INSERT INTO AdminAccount (Email,Password,IsActive) VALUES ('test#test.com','password',1)
INSERT INTO AdminAccount (Email,Password,IsActive) VALUES ('test2#test.com','password2',0)
INSERT INTO AdminAccount (Email,Password,IsActive) VALUES ('test3#test.com','password3',0)
SELECT * FROM AdminAccount
DECLARE #EmailParam VARCHAR(100) = 'test2#test.com'
DECLARE #PasswordParam VARCHAR(50) = 'password'
DECLARE #ReturnValue INT
DECLARE #LocalEmail VARCHAR(100)
DECLARE #LocalPassword VARCHAR(50)
DECLARE #LocalActive BIT
SELECT #LocalEmail = Email, #LocalPassword = Password, #LocalActive = IsActive FROM AdminAccount WHERE Email=#EmailParam
SET #ReturnValue =
CASE
WHEN #LocalEmail IS NULL AND #LocalPassword IS NULL
THEN 0 -- No User
WHEN #LocalPassword = #PasswordParam AND #LocalActive = 1
THEN 1 -- Active User
WHEN #LocalPassword = #PasswordParam AND #LocalActive = 0
THEN 2 -- Inactive User
WHEN #LocalPassword <> #PasswordParam
THEN 4 -- Invalid Password
END
SELECT #ReturnValue
Here is the updated stored procedure using the local variable logic above.
CREATE PROCEDURE [dbo].[SP_Login]
#Email VARCHAR(100),
#Password VARCHAR(50),
#ReturnValue INT OUTPUT
AS
BEGIN
-- Declare local variables to avoid multiple queries
DECLARE #LocalEmail VARCHAR(100)
DECLARE #LocalPassword VARCHAR(50)
DECLARE #LocalActive BIT
-- Gather data
SELECT #LocalEmail = Email, #LocalPassword = Password, #LocalActive = IsActive FROM AdminAccount WHERE Email=#EmailParam
SET #ReturnValue =
CASE
WHEN #LocalEmail IS NULL AND #LocalPassword IS NULL
THEN 0 -- No User
WHEN #LocalPassword = #PasswordParam AND #LocalActive = 1
THEN 1 -- Active User
WHEN #LocalPassword = #PasswordParam AND #LocalActive = 0
THEN 2 -- Inactive User
WHEN #LocalPassword <> #PasswordParam
THEN 4 -- Invalid Password
END
END