CODEWITHSUNDEEP
phphashbcryptverify
astronomicalXoom
astronomicalXoom

Reputation: 107

Cannot verify password in PHP

On this project, I've used BCRYPT to make a hash off the password

On logging in, the user normally logging in without any errors or whatsoever, but when trying to change your password, your current password does not match with the password in the database (of course i'm using password_verify() to verify the two passwords)

Here is the snippet of my code:

  $option = ['cost' => 12];
  $password = password_hash($_currentpassword, PASSWORD_BCRYPT, $option);

  $selectpasswordsql = "SELECT `password` FROM `auth` WHERE username=?";
  $selectpasswordstmt = $conn->prepare($selectpasswordsql);
  $selectpasswordstmt->execute(array($_SESSION['account']['username']));
  $selectpasswordresults = $selectpasswordstmt->fetch(PDO::FETCH_ASSOC);

  $databasepass = $selectpasswordresults['password'];
  $databasepass = trim($databasepass);
  if(password_verify($password,$databasepass)){
    if(empty($passmsgs)){
      $updatepasssql = "UPDATE `auth` SET
        `password`=?
      WHERE username=?
      ";
      $updatepassstmt = $conn->prepare($updatepasssql);
      $updatepassstmt->execute(array($password, $_SESSION['account']['username']));
      if($updatepassstmt){
        array_push($passmsgs, 'Successfully updating your password!');
      } else {
        array_push($passmsgs, 'There was a problem executing your command!');
      }
    }
  } else {
    array_push($passmsgs, 'Your current password is wrong!');
  }

Trying this out will cause an error of not matching your current password with the password

Edit: Yes I am using VARCHAR with a maximum length of 255

Edit 2: Here is a link to the full copy of my codes.

Upvotes: 0

Views: 612

Answers (1)

Ataur Rahman
Ataur Rahman

Reputation: 1791

You don't need to hash your $_currentpassword variable in the second line.

Just pass the variable to the password_verify function and the function itself will do the job.

Upvotes: 3

Related Questions