title: How to use the sql function CONCAT with a prepared statement
body: <p><strong>SCROLL DOWN TO HELP ME, THE PROBLEM IS EXPLAINED.</strong></p>
  
  <p><strong>PROBLEM ALMOST SOLVE !</strong></p>
  
  <p>I am trying to perform an automatic login script with cookies and I came across a very interesting tutorial: <a href="http://blog.monstruosor.com/2013/05/18/php-auto-connexion-par-cookie/" rel="nofollow">http://blog.monstruosor.com/2013/05/18/php-auto-connexion-par-cookie/</a></p>
  
  <p>Here is the code he proposes :</p>
  
  <pre><code>function autologin() {
  $key = $_COOKIE['autologin'];
  
  $ip = $_SERVER['REMOTE_ADDR'];
  
  $query = "SELECT * FROM users WHERE SHA1(CONCAT('SEL1-df546', `name`, `id`, 'SEL2-sd55fd', `last_connection`, $ip))=$key";
  $infos = $users-&gt;exec($query);
  
  if(!is_array($infos) || empty($infos)) {
      // Mauvais cookie !
      return false;
  }
  
  $_SESSION['user'] = $infos; // Mise en SESSION
  return true;
  </code></pre>
  
  <p>The main line that interests me is this one: </p>
  
  <pre><code>$query = "SELECT * FROM users WHERE SHA1(CONCAT('SEL1-df546', `name`, `id`, 'SEL2-sd55fd', `last_connection`, $ip))=$key";
  $infos = $users-&gt;exec($query);
  </code></pre>
  
  <p>However, it is not secure. I want to know how to use an application prepared on this line.
  I tried this but it does not work:</p>
  
  <pre><code>    $req = $this-&gt;_db-&gt;prepare("SELECT * FROM Members WHERE SHA1(CONCAT(HASH1-1dg9sf', `id`, `first_name`, 'HASH2-dt5w1q', `last_name`, ip = :ip)) = :key");
      $req-&gt;execute(array(
          'ip' =&gt; htmlspecialchars($ip),
          'key' =&gt; htmlspecialchars($key)));
  </code></pre>
  
  <p>The  <code>$this-&gt;_db</code> is from my class and is well written don't worry. The problem comes from here :</p>
  
  <pre><code>$req = $this-&gt;_db-&gt;prepare("SELECT * FROM Members WHERE SHA1(CONCAT(HASH1-1dg9sf', `id`, `first_name`, 'HASH2-dt5w1q', `last_name`, ip = :ip)) = :key");
  </code></pre>
  
  <p>Hope someone has a solution.</p>
  
  <hr>
  
  <p>Here's more information :</p>
  
  <p>my index.php page contains :</p>
  
  <pre><code>$ip = $_SERVER['REMOTE_ADDR'];
  $key = $_COOKIE['auto_login'];
  $mg-&gt;autoLogin($ip, $key);
  </code></pre>
  
  <p>and my autoLogin method from my class :</p>
  
  <pre><code>    public function autoLogin($ip, $key)
  {
      $req = $this-&gt;_db-&gt;prepare("SELECT * FROM Members WHERE SHA1(CONCAT(HASH1-1dg9sf', `id`, `first_name`, 'HASH2-dt5w1q', `last_name`, :ip)) = :key");
      $req-&gt;execute(array(
          'ip' =&gt; htmlspecialchars($ip),
          'key' =&gt; htmlspecialchars($key)));
      $donnee = $req-&gt;fetch();    
      $req-&gt;closeCursor();
      if(!is_array($donnee) || empty($donnee)) 
      {
         return false;
      }
      else
      {
          $_SESSION['user'] = $donnee;
          return true;
      }
  }
  </code></pre>
  
  <p>If you still need <strong>more information, just ask me</strong>, I'll update my question again !</p>
  
  <hr>
  
  <p><strong>HERE'S THE LAST PROBLEM</strong></p>
  
  <p><strong>Thanks to pala_ who almost resolve it</strong></p>
  
  <p>I know where the problem is. 
  In my database, the IP stored of the member I'm trying to log in is " ::1 ". But when I do " echo $ip; " which is generated here : "$ip = $_SERVER['REMOTE_ADDR']; ", I have " 127.0.0.1 " ! It's not the same IP when I do my verification so the problem is probably here ! Any idea how to fix this ? </p>
  
  <p>The problem is here because if I do " $ip = '::1'; ", it's WORKING. Any idea??</p>