CODEWITHSUNDEEP
phppasswords
chi
chi

Reputation: 357

Password_verify doesn't check correctly

Big problem with password_verify.

In my db there is a column:

password:  $2y$10$1k72g4qYgd4t5koC5hj8sOit3545GfO5EhaIwVRfIiA2/eC3Hnu5e ('b')

When I want to check in order that this password is equal the letter a it given my completely 2 different codes.My code:

$hash = password_hash('b', PASSWORD_DEFAULT);
$pass = getPassword($email);
echo $hash . ", " $pass;

and it gives me:

$2y$10$oJbeQqGSee.pLcBNxqRzUecoCGc9fin7IF.evDVanN1pjmtIINSD2,
$2y$10$1k72g4qYgd4t5koC5hj8sOit3545GfO5EhaIwVRfIiA2/eC3Hnu5e

Why there are different?

Upvotes: 0

Views: 91

Answers (2)

msaw328
msaw328

Reputation: 1569

It's because when not specified by the user, password_hash will generate a random salt. Salt is a string that is appended to a password before hashing. Thanks to salts being random, two users with same password will still have different hashes in database.

Good summary of the topic can be found on the wikipedia

In order to verify that the password is correct, you shouldn't manually compare hashes, which may be different with each use of password_hash because of random salts, but rather use function password_verify

Upvotes: 2

Matt Altepeter
Matt Altepeter

Reputation: 956

You should use password_hash() before inserting into your storage and then when you verify you should use password_verify()

$pass = getPassword($email);
$verify = password_verify('b', $pass);

if ($verify) {
     // passwords match
}
else {
    // passwords do not match
}

See: password-verify for more info

Upvotes: 1

Related Questions