Vfrdtyky

I want to change my auth method from giving the username/password to giving the user ID/password.

I checked the auth.php file ( in /phpbb/auth/auth.php ) which includes the login() function. I've found a query :

$sql = 'SELECT user_id, username, user_password, user_passchg, user_pass_convert, user_email, user_type, user_login_attempts

            FROM ' . USERS_TABLE . "

            WHERE username_clean = '" . $this->db->sql_escape($username_clean) . "'";

I've changed it into :

$sql = 'SELECT user_id, username, user_password, user_passchg, user_email, user_type

            FROM ' . USERS_TABLE . "

            WHERE user_id == ' . $user_id . '";

But I'm not able to log with my ID/password.

You are mixing up your ' and " signs which is inevitably breaking your query. Instead of $user_id variable value being inserted into the query, it is literally inserting $user_id.

$sql = 'SELECT user_id, username, user_password, user_passchg, user_email, user_type

FROM ' . USERS_TABLE . ' WHERE user_id == ' . $user_id . ';

That would fix that issue. Even still I think you are only supposed to have a single '=' and there appears to be some more issues.

Also I assume $user_id is an integer, but if it's a user-inputted string, then please sanitize it to prevent SQL Injection.