Reputation: 107
On this project, I've used BCRYPT to make a hash off the password
On logging in, the user normally logging in without any errors or whatsoever, but when trying to change your password, your current password does not match with the password in the database (of course i'm using password_verify()
to verify the two passwords)
Here is the snippet of my code:
$option = ['cost' => 12];
$password = password_hash($_currentpassword, PASSWORD_BCRYPT, $option);
$selectpasswordsql = "SELECT `password` FROM `auth` WHERE username=?";
$selectpasswordstmt = $conn->prepare($selectpasswordsql);
$selectpasswordstmt->execute(array($_SESSION['account']['username']));
$selectpasswordresults = $selectpasswordstmt->fetch(PDO::FETCH_ASSOC);
$databasepass = $selectpasswordresults['password'];
$databasepass = trim($databasepass);
if(password_verify($password,$databasepass)){
if(empty($passmsgs)){
$updatepasssql = "UPDATE `auth` SET
`password`=?
WHERE username=?
";
$updatepassstmt = $conn->prepare($updatepasssql);
$updatepassstmt->execute(array($password, $_SESSION['account']['username']));
if($updatepassstmt){
array_push($passmsgs, 'Successfully updating your password!');
} else {
array_push($passmsgs, 'There was a problem executing your command!');
}
}
} else {
array_push($passmsgs, 'Your current password is wrong!');
}
Trying this out will cause an error of not matching your current password with the password
Edit: Yes I am using VARCHAR
with a maximum length of 255
Edit 2: Here is a link to the full copy of my codes.
Upvotes: 0
Views: 612
Reputation: 1791
You don't need to hash your $_currentpassword
variable in the second line.
Just pass the variable to the password_verify
function and the function itself will do the job.
Upvotes: 3