Is this a secure method, oop
<pre><code>    $salt = $this-&gt;get_salt($username);

    if (is_null($salt)) {
        return FALSE;
    }

    $password = sha1(SITE_KEY . $password . $salt);
    $sth = $this-&gt;db-&gt;prepare("SELECT id, username, active FROM user WHERE username = ? AND password = ?");
    $sth-&gt;setFetchMode(PDO::FETCH_OBJ);
    $sth-&gt;execute(array($username, $password));

    if (($result = $sth-&gt;fetch()) !== FALSE) {
        return $result;
    }

    return FALSE;
</code></pre>

<p>This is what make me concerned:</p>

<blockquote>
  <p>I did not misunderstand the login method. I just don't think it should
  return that object. I may be wrong and what you are doing is perfectly
  fine, but I doubt it. You are returning the full user object from the
  database, password and all, to a potentially insecure script. Someone
  could potentially create a new file and then do something like
  var_dump($userObject); and have all that information</p>
  
  <p>Also, I just find it unintuitive to return a "magic" property from
  something. It's just another one of those things that is not verified
  before being used. If you were to move that to a separate method in
  your auth class and have it return the value of "active" you could run
  any verification you needed to without your login.php script being any
  the wiser.</p>
  
  <p>: Looked at it again, and while you would already need to know the
  login information if you were to abuse that object in that way. It is
  still better, in my opinion, to separate it in case there is some sort
  of leak. Not saying I know how someone would be able to do it. Just
  think of it as one less potential loop hole.</p>
  
  <p>I don't pretend to understand how malicious users would do something.
  I just know that making it easier for them to do so doesn't seem wise.
  Maybe there isn't anything wrong with it, I'm not a security expert.
  I'm just poking at things that, if I were to write it, I would change
  because they seem hazardous to me. If you truly wish to know if it is
  dangerous or not, I'd suggest submitting that example to the regular
  stackoverflow community to see what they say.</p>
</blockquote>

<p>Do He have some point of what he saying? The method would be used in a page controller I have:</p>

<pre><code>$user = $auth-&gt;login('username, password)

if ($user) {
//do some additional checks... set session variables
}
</code></pre>
