How about something along these lines:
ptr = strtok(verifyUser, ", ");
if (!ptr || strcmp(ptr, user))
continue;
/* Okay, so the user matches. */
char *pass = strtok(NULL, ", ");
if (!pass || strcmp(pass, password)) {
/* Invalid. */
break;
}
Of course this code assumes you already trust the strings user
and password
and it's also untested.