storing the password in DB directly is bad idea. First of all you should store this as MD5 or something like that and client application don't know algorithm to hash. Anyway, your second way don't return any user because you search an user with empty password
It is executing with no errors , however it is returning null. and leave empty password consider wrong password
then what do you say on this?