CODEWITHSUNDEEP
phpmysql
James Green
James Green

Reputation: 29

password_verify keeps bringing back false

ok so ive got password_hash working on one of my pages.

I'm wondering how would i apply password_verify to the following code:

function selectUser($conn, $username, $password) {

$query = "SELECT username, password FROM login WHERE password = :password AND username = :username";

$stmt = $conn->prepare($query);
$stmt->bindValue(':username', $username);
$stmt->bindValue(':password', $password);
$stmt->execute();


if ($row = $stmt->fetch()) {
    $_SESSION['username'] = $username;
    $_SESSION['password'] = $password;
    echo "Welcome, you are now logged in as " . $username;
    return true;
}

else {
    //echo "Your details were not found";
    return false;
}

tried it myself and its been very confusing to me.

thank you

also got this:

if(!isset($_POST["Login"]))
{
    header("Location:new-user.php");
}


$username=trim($_POST['username']);
$password=$_POST['password'];

$username= htmlspecialchars($username);
$validForm = true;

if (empty($_POST["username"]))
            {
            $validForm=false;
            }
if (empty($_POST["password"]))  
            {
            $validForm=false;
            }
if (!$validForm) {

$error = "please ensure all fields are filled in";
include("add.php");
return false;

}           
        

$conn=getConn();
$successLogin=selectUser($conn,$username,$password);
if($successLogin)
{
       header( "Location: search.php" );
}else{
       $error = "The details you have entered are incorrect";
      include("add.php"); 
}

$conn=NULL; //close the connection

Update

also tried this: Knowing this doesnt work, tested with echo statements but still no luck

function hash_input() {

$password = "sfafgsd";

return $password = password_hash($_POST['password'], PASSWORD_BCRYPT);
}



function selectUser($conn, $username, $password)
{
    $query = "SELECT password FROM login WHERE username = :username"; 
    $stmt = $conn->prepare($query);
    $stmt->bindValue(':username', $username);
    $stmt->execute();
echo $username . " " . $password;
    if ($row = $stmt->fetch(PDO::FETCH_ASSOC))
    {
        echo "WE MADE IT"; 
        if(password_verify(hash_input($password), $row['password'])){  
            $_SESSION['username'] = $username;
            echo "Welcome, you are now logged in as " . $username; 
            return true;
        }

        //echo "Your details were not found";
        sleep(1); 
        return false; 
    }
    else
    {
        //echo "Your details were not found";
        return false;
    }
}

Upvotes: 1

Views: 119

Answers (1)

Martin
Martin

Reputation: 22760

The comments given by Mark cover the below exactly.

Order of events:

  • Send username to database and collect the hashed password from the row found.
  • run the password string given through password_verify to compare with the hashed value
  • return this result (true/false).
  • Celebrate. Have a coffeee or a tea.

There is no need to $_SESSION password data and this is a bad idea. Password data (hash or plaintext) should not be retained beyond this function call. If you do for some reason need to have a nonce value associated with this account/membership/login then this should be setup using a random string in its own column in the database.

Improved Function Code

function selectUser($conn, $username, $password)
{
    $query = "SELECT password FROM login WHERE username = :username LIMIT 1"; 
    $stmt = $conn->prepare($query);
    $stmt->bindValue(':username', $username);
 // $stmt->bindValue(':password', $password); NO Don't do this.
    $stmt->execute();

    if ($row = $stmt->fetch(PDO::FETCH_ASSOC))
    {
        if(password_verify($password,$row['password'])){
            $_SESSION['username'] = $username;
   //       $_SESSION['password'] = $password; DO NOT DO THIS
            echo "Welcome, you are now logged in as " . $username; 
            return true;
        }
        //bad password
        //echo "Your details were not found";
        sleep(1); // it can be a good idea to add a forced pause on
                  // password fail to discourage brute force cracking. 
        return false; 
    }
    //echo "Your details were not found";
    return false;
}

Upvotes: 2

Related Questions