Accessing Associative Indexes Produced by PDO FETCH_ASSOC - sql

Question

I fully admit must have a faulty understanding of the construction of an associative array.
The following login script will populate $userdata with an associative array consisting of $username's hashed password and salt as queried from the SQL Server database (Azure SQL to be specific). However, the portions of the code that are working on creating a hash of the supplied password and comparing against the hashed password found in the DB fail with errors indicating that $userdata[password] and $userdata[salt] are undefined.
<?php
$username = $_POST['username'];
$password = $_POST['password'];
// Connect to SQL Server
include '../../phpconfig/connectstrings.php';
try
{
$conn = new PDO ( "sqlsrv:server = $serverstringname; Database = $databasestringname", "$usernamestringname", "$passwordstringname");
$conn->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION, );
}
catch ( PDOException $e )
{
print( "Error connecting to SQL Server." );
die(print_r($e));
}
catch(Exception $e)
{
die(var_dump($e));
}
//Query database for the hashed password and salt for the supplied username
if(!empty($_POST)) {
try
{
$sql_select = $conn->prepare("SELECT password, salt FROM logins WHERE username = '$username'");
$sql_select->execute();
}
catch(Exception $e)
{
die(var_dump($e));
}
//Fetch all of the remaining rows in the result set
$userdata = $sql_select->fetchAll(PDO::FETCH_ASSOC);
//check for a valid username
if(empty($userdata))
{
echo "User: $username was not found";
die;
}
//hash the queried salt and hash the supplied password
$hash = hash('sha256', $userdata['salt'] . hash('sha256', $password) );
//compare the hashed salted password supplied with that queried from database
if($hash = $userdata['password'])
{
echo "Welcome, $username!";
}
else
{
echo "Invalid password";
}
}
?>
While I don't doubt some of the code beyond fetching the array from $sql_select needs some debugging I can't get that far because $userdata appears to get all of the associative array data assigned to a single portion of the variable as indicated by the output of the following dumps:
var_dump($sql_select);
//output = object(PDOStatement)#2 (1) { ["queryString"]=> string(61) "SELECT password, salt FROM logins WHERE username = 'mrtactics'" }
list($a[0], $b[1]) = $userdata;
var_dump($a);
var_dump($b);
//output = array(1) { [0]=> array(2) { ["password"]=> string(64) "f24704c0ce72a618cf1738894ebdd6001f4d3329802ab83bd418df66cbc46b1a" ["salt"]=> string(3) "6e0" } } array(1) { [1]=> NULL }
var_dump($userdata["salt"]);
//output = NULL
var_dump($userdata['salt']);
//output = NULL
var_dump($userdata['password']);
//output = NULL
foreach ($userdata as $item => $value)
echo "$item: $value<br>";
//output = 0: Array
$password = $sql_select->fetchColumn(0);
$salt = $sql_select->fetchColumn(1);
var_dump($password);
var_dump($salt);
//output = string(64) "f24704c0ce72a618cf1738894ebdd6001f4d3329802ab83bd418df66cbc46b1a" bool(false)
The obvious workaround is to query a single value for the supplied username and pass each tot heir respective variables. However, this requires twice the necessary calls to the DB and I don't learn anything about how associative arrays are constructed and how I can get use the information stored within them.
I suspect I'm either fetching an object of the wrong construction for the method I am trying to retrieve from it or my syntax is just plain bad. I do intend to remain using PDO as opposed to sql_* commands.
EDIT: Let's make this more simple, then:
$userdatasql = $sql_select->fetchAll(PDO::FETCH_ASSOC);
$userdata['password']="f24704c0ce72a618cf1738894ebdd6001f4d3329802ab83bd418df66cbc46b1a";
$userdata['salt']="6e0";
var_dump($userdata);
var_dump($userdatasql);
var_dump($userdata['password']);
var_dump($userdatasql['password']);
//Dump of $userdata = array(2) { ["password"]=> string(64) "f24704c0ce72a618cf1738894ebdd6001f4d3329802ab83bd418df66cbc46b1a" ["salt"]=> string(3) "6e0" }
//Dump of $userdatasql = array(1) { [0]=> array(2) { ["password"]=> string(64) "f24704c0ce72a618cf1738894ebdd6001f4d3329802ab83bd418df66cbc46b1a" ["salt"]=> string(3) "6e0" } }
Note the difference in the construction of these 2 arrays? I don't know exactly what it means which is why I'm here. If I were guessing it appears that the $userdatasql array contains an array within an array so calls must be indexed as such.
//Dump of $userdata['password'] = string(64) "f24704c0ce72a618cf1738894ebdd6001f4d3329802ab83bd418df66cbc46b1a"
//Dump of $userdatasql['password'] = NULL
MORE INFO:
echo (count($userdata));
echo (count($userdatasql));
//output = 2
//output = 1
echo (count($userdata, 1));
echo (count($userdatasql, 1));
//output = 2
//output = 3
This tells me that the array created by PDO FETCH_ASSOC is of a different construction than an array manually created but containing the same 2 pieces of data and the same 2 indexes.
Armed with this knowledge I modified my dump to include the 0 index location and suddenly the expected data was being output:
var_dump($userdatasql['0']['password']);
var_dump($userdatasql['0']['salt']);
//password dump = string(64) "f24704c0ce72a618cf1738894ebdd6001f4d3329802ab83bd418df66cbc46b1a"
//salt dump = string(3) "6e0"
Does this mean that I must reference all PDO FETCH ASSOC arrays by index?
I should think not since no code examples I find show this.
So, then, why is my PDO FETCH ASSOC array malformed?

Answer 1

Well, I have the "answer" in the sense that I can format the syntax to retrieve the necessary information from the associative array. I do not understand the difference between a manually created associative array and one created by PDO FETCH ASSOC nor what the implications are going to be later on when my arrays are significantly more complex than the one posed here.
But, here's the "answer":
The information stored in the associative array created by PDO FETCH ASSOC must be referenced by the numerical index THEN the associative index despite being an associative array not of the numerical type (because that makes loads of sense, right?) By including the numerical index prior to the associative index the value was correctly obtained.
$var[0][index] //retrieves correctly
$var[index] //does not unless the array happened to be manually constructed
And the final, for real answer, deduced after hours of studying other relevant code examples:
My code is performing as it is because I am using ->fetchAll as opposed to ->fetch. When I use simply ->fetch I no longer have to reference both numerical and associative indexes and can simply reference the associative index as expected for an associative array.
The corrected code syntax follows:
<?php
$username = $_POST['username'];
$password = $_POST['password'];
// Connect to SQL Server
include '../../phpconfig/connectstrings.php';
try
{
$conn = new PDO ( "sqlsrv:server = $serverstringname; Database = $databasestringname", "$usernamestringname", "$passwordstringname");
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
}
catch ( PDOException $e )
{
print( "Error connecting to SQL Server." );
die(print_r($e));
}
catch(Exception $e)
{
die(var_dump($e));
}
//Query database for the hashed password and the salt for the supplied username
if(!empty($_POST)) {
try
{
$sql_select = "SELECT password, salt FROM logins WHERE username = ?";
$stmt = $conn->prepare($sql_select);
$stmt->bindValue(1, $username);
$stmt->execute();
}
catch(Exception $e)
{
die(var_dump($e));
}
//Fetch the result set into an associative array
$userdata = $stmt->fetch(PDO::FETCH_ASSOC);
if(empty($userdata))
{
echo "User: $username was not found";
die;
}
//hash the queried salt with a hash of the supplied password
$hash = hash('sha256', $userdata['salt'].hash('sha256', $password));
//compare the hashed salted password supplied with that queried from database
if($hash == $userdata['password'])
{
echo "Welcome, $username!";
}
else
{
echo "Invalid password";
//does the user wish to register> -> header('Location: register.php');
die;
}
}
?>