title: Use stored salt in concat
body: <p>Consider the following query which returns the same output whether the username is invalid or whether the password is wrong (just an example, I know about SQL Injection):</p>
  
  <pre><code>CREATE TABLE users (
      username VARCHAR(64),
      password CHAR(40)
  );
  
  SELECT FROM users
        WHERE username = '{$username}'
          AND password = sha1('{$password}');
  </code></pre>
  
  <p>I would like to add a salt field, but rather than retrieve it and concatenate in the application, I would prefer that MySQL do the concatenation in the engine:</p>
  
  <pre><code>CREATE TABLE users (
      username VARCHAR(64),
      salt VARCHAR(128),
      password CHAR(40)
  );
  
  SELECT FROM users
        WHERE username = '{$username}'
          AND password = sha1(CONCAT(&lt;salt_field&gt;, '{$password}'));
  </code></pre>
  
  <p>What would I replace <code>&lt;salt_field&gt;</code> with?</p>