when you create a new security module and use the group security, SC create 2 forms:
1.- secur_form_add_users. This form is to create a user, so the password compare and hash (in my case sha256) is coded at OnBeforeInsert, so it is OK.
2.-secur_form_edit_users. This form is used to modify the user, including the password. so the password compare and hash (in my case sha256) should be coded at OnbeforeUpdate, but is coded onBeforeInsert event, and it is nothing coded at OnbeforeUpdate, so the password hasn?t the hash and it is saved in plain format at database. After this, the user cannot login because it hasn?t the SHA codification.
cant you move the code to onBeforeUpdate and see what happens?
If I do it works fine, but this code is generated by SC when you generate the security module.