QuickBooks/Driver/Sql.php
protected function _authLogin($username, $password, &$company_file, &$wait_before_next_update, &$min_run_every_n_seconds, $override = false)
	{
		$errnum = 0;
		$errmsg = '';

		if ($override) // We still need to make sure that the user exists, even if using external authentication
		{
			$this->authCreate($username, $password);
		}
		else if (strlen(trim($password)) == 0)
		{
			// Blank passwords *always fail*
			return null;
		}
		else if (strlen(trim($password)) == 32 or strlen(trim($password)) == 40)
		{
			// Possible *hack* attempt (they're sending us a random hash hoping it will match one of the hashed passwords)
			return null;
		}

		// Support for plain-text, MD5 (without salt), and SHA1 (without salt) passwords
		$plain_text = $password;
		$plain_md5 = md5($password);
		$plain_sha1 = sha1($password);

		if ($override or
			$arr = $this->_fetch($this->_query("
				SELECT
					*
				FROM
					" . $this->_mapTableName(QUICKBOOKS_DRIVER_SQL_USERTABLE) . "
				WHERE
					qb_username = '" . $this->_escape($username) . "' AND
					(
						qb_password = '" . $this->_escape($this->_hash($password)) . "' OR
						qb_password = '" . $this->_escape($plain_text) . "' OR
						qb_password = '" . $this->_escape($plain_md5) . "' OR
						qb_password = '" . $this->_escape($plain_sha1) . "'
					) AND
					status = '" . QUICKBOOKS_USER_ENABLED . "' ", $errnum, $errmsg, 0, 1)))
		{
			//$ticket = md5((string) microtime() . $username . $this->_mapTableName(QUICKBOOKS_DRIVER_SQL_SALT));
			$ticket = QuickBooks_WebConnector_QWC::GUID(false);

			$this->_query("
				INSERT INTO
					" . $this->_mapTableName(QUICKBOOKS_DRIVER_SQL_TICKETTABLE) . "
				(
					qb_username,
					ticket,
					ipaddr,
					write_datetime,
					touch_datetime
				) VALUES (
					'" . $this->_escape($username) . "',
					'" . $this->_escape($ticket) . "',
					'" . $_SERVER['REMOTE_ADDR'] . "',
					'" . date('Y-m-d H:i:s') . "',
					'" . date('Y-m-d H:i:s') . "'
				) ", $errnum, $errmsg);

			$this->_query("
				UPDATE
					" . $this->_mapTableName(QUICKBOOKS_DRIVER_SQL_USERTABLE) . "
				SET
					touch_datetime = '" . date('Y-m-d H:i:s') . "'
				WHERE
					qb_username = '" . $this->_escape($username) . "' ", $errnum, $errmsg);

			if (isset($arr) and
				is_array($arr))		// Might not have this if it's an authenticate override
			{
				$company_file = $arr['qb_company_file'];
				$wait_before_next_update = $arr['qbwc_wait_before_next_update'];
				$min_run_every_n_seconds = $arr['qbwc_min_run_every_n_seconds'];
			}

			return $ticket;
		}

		return null;
	}
protected function _authLogin($username, $password, &$company_file, &$wait_before_next_update, &$min_run_every_n_seconds, $override = false)
	{
		$errnum = 0;
		$errmsg = '';

		if ($override) // We still need to make sure that the user exists, even if using external authentication
		{
			$this->authCreate($username, $password);
		}
		else if (strlen(trim($password)) == 0)
		{
			// Blank passwords *always fail*
			return null;
		}
		else if (strlen(trim($password)) == 32 or strlen(trim($password)) == 40)
		{
			// Possible *hack* attempt (they're sending us a random hash hoping it will match one of the hashed passwords)
			return null;
		}

		// Support for plain-text, MD5 (without salt), and SHA1 (without salt) passwords
		$plain_text = $password;
		$plain_md5 = md5($password);
		$plain_sha1 = sha1($password);

		if ($override or
			$arr = $this->_fetch($this->_query("
				SELECT
					*
				FROM
					" . $this->_mapTableName(QUICKBOOKS_DRIVER_SQL_USERTABLE) . "
				WHERE
					qb_username = '" . $this->_escape($username) . "' AND
					(
						qb_password = '" . $this->_escape($this->_hash($password)) . "' OR
						qb_password = '" . $this->_escape($plain_text) . "' OR
						qb_password = '" . $this->_escape($plain_md5) . "' OR
						qb_password = '" . $this->_escape($plain_sha1) . "'
					) AND
					status = '" . QUICKBOOKS_USER_ENABLED . "' ", $errnum, $errmsg, 0, 1)))
		{
			//$ticket = md5((string) microtime() . $username . $this->_mapTableName(QUICKBOOKS_DRIVER_SQL_SALT));
			$ticket = QuickBooks_WebConnector_QWC::GUID(false);

			$this->_query("
				INSERT INTO
					" . $this->_mapTableName(QUICKBOOKS_DRIVER_SQL_TICKETTABLE) . "
				(
					qb_username,
					ticket,
					ipaddr,
					write_datetime,
					touch_datetime
				) VALUES (
					'" . $this->_escape($username) . "',
					'" . $this->_escape($ticket) . "',
					'" . $_SERVER['REMOTE_ADDR'] . "',
					'" . date('Y-m-d H:i:s') . "',
					'" . date('Y-m-d H:i:s') . "'
				) ", $errnum, $errmsg);

			$this->_query("
				UPDATE
					" . $this->_mapTableName(QUICKBOOKS_DRIVER_SQL_USERTABLE) . "
				SET
					touch_datetime = '" . date('Y-m-d H:i:s') . "'
				WHERE
					qb_username = '" . $this->_escape($username) . "' ", $errnum, $errmsg);

			if (isset($arr) and
				is_array($arr))		// Might not have this if it's an authenticate override
			{
				$company_file = $arr['qb_company_file'];
				$wait_before_next_update = $arr['qbwc_wait_before_next_update'];
				$min_run_every_n_seconds = $arr['qbwc_min_run_every_n_seconds'];
			}

			return $ticket;
		}

		return null;
	}
Log a user in

@param string $username
@param string $password
@param boolean $override		If this is set to TRUE, a correct password *is not* required
@return string				A session ticket, or an empty string if the login failed