title: MySQL AES_DECRYPT in NodeJS, placeholder for encryption key?
body: <p>I found similar replies but nothing really straightforward.
  How can AES_DECRYPT be used only for the password field in a query using MySQL extension in NodeJS ?
  What I have is as follow:</p>
  <pre><code>app.post(&quot;/verify&quot;,function(req,res){
      connection.query('SELECT *, FROM `bosses` where u=? and p=?', [req.body.user,req.body.pass], function (error, results, fields) {
              if(results.length){
                  session.loggedin=1;
                  res.redirect('/zirkus');
              }else{
                  res.redirect('/soccer');
              }
          });
  </code></pre>
  <p>I assume that I need to modify the query with something like this:</p>
  <pre><code>connection.query('SELECT *, FROM `bosses` where u=? and p=AES_DECRYPT (?, 'ENCRYPTIONKEY')', [req.body.user,req.body.pass], function (error, results, fields) {
  </code></pre>
  <p>but somehow I can't get it to work properly. Should I use a placeholder for the encryption key too ?</p>
  <p><strong>EDIT</strong></p>
  <p>Thanks for the replies and explanation on why this was generally a bad idea :)</p>
  <p>Here is a variation: no decryption password is stored in the code:</p>
  <pre><code>connection.query('SELECT *, AES_DECRYPT(p, ?) AS `key` FROM bosses WHERE u = ?', [req.body.pass,  req.body.user], function (error, results, fields) {
  
  console.log (req.body.pass + req.body.user )
  
      
  
  if(results[0].key){
                  session.loggedin=1;
                  res.redirect('/zirkus');
              }else{
                  res.redirect('/soccer');
              }
          });
  
  
  });
  </code></pre>
  <p>Here the admin user types the decryption password in the form and if the decryption is successful (the key returns true) it allows the user to log in (without using or saving the password) else access is denied.</p>
  <p>I assume that in this solution the only downside are the mysql logs right ?</p>