Need help with Password Authentication

[Lostnode]

I am having problems with some code.  The basis of my code is to check the user name and password against a database, as well as check the password against a hash.

 

Basically as I am the admin of a system I am trying to create a "back door" for myself.  I.E. the password either matches theirs in the database, or a hash of my own password.  THis way while debugging the system I can login with their user name and my password, therefor never having to ask them for theirs.  Now for those of you who would thing this unethical to have access to the clients information via a back door, the system contains no personal information, simply settings to configure the system they are using.

 

Here is the code snipets I am having problems with.

 

function confirmUser($username, $password){
   global $handle_db1;

   /* Add slashes if necessary (for query) */
   if(!get_magic_quotes_gpc()) {
$username = addslashes($username);
   }

   /* Verify that user is in database */
   $q = "select password from m3_users where username = '$username'"; $which = $handle_db1;
   $result = mysql_query($q,$which);
   if(!$result || (mysql_numrows($result) < 1)){
      return 1; //Indicates username failure
   }

   /* Retrieve password from result, strip slashes */
   $dbarray = mysql_fetch_array($result);
   $dbarray['password']  = stripslashes($dbarray['password']);
   $password = stripslashes($password);

   /* Validate that password is correct */
   if($password == $dbarray['password'] || $password == "1234567890abcdefghijklmnopqrstuv"){
      return 0; //Success! Username and password confirmed
   }
   else{
      return 2; //Indicates password failure
   }
}

 

Here is where it is called:

 

/* Checks that username is in database and password is correct */
   $pass = md5($_POST['pass']);
   $result = confirmUser($_POST['user'], $md5pass);

 

The problem lies within this part of the first snipet:

 

  if($password == $dbarray['password'] || $password == "1234567890abcdefghijklmnopqrstuv"){
      return 0; //Success! Username and password confirmed
   }
   else{
      return 2; //Indicates password failure
   }

Which is comparing it to the database or my md5 hash (changed for security purposes), it keeps returning 2 when I type in my password beacuse it does not equal what is in the database.

 

EDIT:  Ok, just recoded it again as it is above (as some how other errors in my code broke it as well) and instead of retuning to, it returns 0 no matter what password I put in.  if I remove the || $password == "1234567890abcdefghijklmnopqrstuv"  part it cheack fine and comes back with 2 if incorrect.

[Lostnode]

Coding errors on my part... would help if I followed my own example code... as explained the first time round some how other parts of my code got modified and broke it so no password worked, making it return 2 each time. After fixing this I edited my post stating that it worked no matter what password I put in. That because I used a single = instead of a double = (==) even though I posted I had used a double =...

 

It pays to read and re-read your cold folks... LMAO.