0

I am in the process of designing a fairly simple login system, and I currently use the following code when a user attempts to log in to determine whether there is an entry in the database that matches the username that the user tries to log in with. (Later in the code, I check for matching passwords, etc.; I'm not worried about that part.)

Currently, I use SELECT to grab the entire database into a variable ($wholeUserDatabase), and then iterate through it to determine whether the 'username' field matches.

It works fine for now. But my database has three users right now. Will this method of grabbing the whole database into a variable become painfully slow when I release the site to the public and (theoretically) get many more users?

$connection = mysql_connect($mysql_host,$mysql_user,$mysql_password);

mysql_select_db($mysql_database, $connection);

// Take the whole user database, and store it in $wholeUserDatabase.
$wholeUserDatabase = mysql_query("SELECT * FROM myTable")
    or die(mysql_error());  

$boolFoundUser = false;

/* Iterate once for every entry in the database, storing the current entry 
of the database into a variable $currentEntry, which is an array containing 
everything related to the one user. */
while($currentEntry = mysql_fetch_array($wholeUserDatabase)) {

    /* Does the "username" field of the current entry match the one 
    the user tried to log in with? */
    if ($currentEntry['username'] == $_POST['username']) {

        /* If it does, break the loop so that the $currentEntry variable 
        will contain the information for the user who is trying to log in,
        which I will later need to check passwords, etc. */
        $boolFoundUser = true;
        break;
    }
}

mysql_close($connection);

Thanks for any help. Let me know if I need to rethink this part. I hope this can be helpful to other people.

3 Answers 3

4

YES! It will be horribly, horribly slow. Do not select the whole database, just select what you need.

1
  • 2
    This. A query should return only the data you need. Anything else is a waste of resources!
    – Mike GB
    Commented Jul 9, 2012 at 23:03
3

I don't understand why you are doing things this way. It kind of defeats the purpose of having a database in the first place. I mean, if you want to do things this way, file i/o would suffice (i.e. wriitng/reading from a plaintext file).

What you want to do is a SELECT * FROM myTable Where username=$username && password==$password...

This is better because (a) you can create indexes on username which would make the database search/find much faster, (b) its far less expensive from i/o and processing perspective as (a) you are not pushing all that data (the entire db) from db to application, (b) mySQL doesn't need to iterate over the entire db if its properly indexed (so faster)...

Regards

2
  • Well the database still brings some advantages such as durability, in theory.
    – Razvan
    Commented Jul 9, 2012 at 23:17
  • Hehe... that's excellent!! Thanks for helping out a beginning MySQL coder who clearly had no idea what he was doing. I had no idea the "Where" function existed! Commented Jul 13, 2012 at 0:30
0

It is obviously a very bad idea to get all the users from the database. To get an idea of how much data transfer you will cause. Imagine you getting 10^5 users after you release it. Let's say the schema of the users table is, at least: users(username varchar(30), password varchar(64)). In this case, You will transfer from the DB machine:

10^5 * (30 + 64) * 2 bytes = 18.8 MB of data.

That's for 10^5 users for whom you have only an username and a pass stored in the DB. What if you get lucky and get 10^6 or 10^7 users ?

In general, you will transfer an amount of data falling in this class: O(users)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.