# CakePHP 3.6: Auth custom finder create wrong SQL query

**URL:** <https://discourse.cakephp.org/t/cakephp-3-6-auth-custom-finder-create-wrong-sql-query/5243>\
**Category:** Uncategorized\
**Created:** [November 12, 2018, 11:57am UTC](https://discourse.cakephp.org/t/cakephp-3-6-auth-custom-finder-create-wrong-sql-query/5243 "2018-11-12T11:57:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Salines](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/salines/32/3166_2.png) [@Salines](https://discourse.cakephp.org/u/Salines)\
**Post date:** [November 12, 2018, 11:57am UTC](https://discourse.cakephp.org/t/cakephp-3-6-auth-custom-finder-create-wrong-sql-query/5243/1 "2018-11-12T11:57:57Z")

</div>

Here is code:

AppController

```
'authenticate' => [
                'Form' => [
                    'finder' => 'emailOrNameAuth',
                    'fields' => ['username' => 'name', 'password' => 'password']
                ]
            ],

```

Users table:  
#options 1:

```
public function findEmailOrNameAuth(\Cake\ORM\Query $query, array $options)
{
    $query
        ->where([
            'OR' => [
                ['email' => $options['username']]
            ],
            'activated' => 1,
        ]);
    return $query;
}
 // FROM 
  users Users 
WHERE 
  (
    Users.name = 'xxxxxx' 
    AND email = 'xxxxxt' 
    AND activated = 1
  ) 

```

Old deprecated options return valid query:

```
public function findEmailOrNameAuth(\Cake\ORM\Query $query, array $options)
{
    $query
       ->orWhere(['email' => $options['username']])
       ->andWhere(['activated' => 1]);
    return $query;
}
// FROM users Users WHERE ((Users.name = :c0 OR email = :c1) AND activated = :c2)

```

> The function `Cake\Database\Query::orWhere()` has been deprecated: 3.5.0 This method creates hard to predict SQL based on the current query state. Use `Query::where()` instead as it has more predicatable and easier to understand behavior.

How to fix?

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [November 12, 2018, 7:54pm UTC](https://discourse.cakephp.org/t/cakephp-3-6-auth-custom-finder-create-wrong-sql-query/5243/2 "2018-11-12T19:54:54Z")

</div>

This is a slightly different problem, but the same solution should apply.

> <https://stackoverflow.com/questions/50333203/case-insensitive-authentication-cakephp-3>

---

<div class="post-metadata">

**Author:** ![Salines](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/salines/32/3166_2.png) [@Salines](https://discourse.cakephp.org/u/Salines)\
**Post date:** [November 13, 2018, 9:42am UTC](https://discourse.cakephp.org/t/cakephp-3-6-auth-custom-finder-create-wrong-sql-query/5243/3 "2018-11-13T09:42:05Z")

</div>

Thanks, I have same answer here:

> <https://github.com/cakephp/cakephp/issues/12722#issuecomment-437913905>