CODEWITHSUNDEEP
phpmysqlpasswordsbcrypt
ABC
ABC

Reputation: 832

php mysql bcrypt and password doesn't match

I'm having trouble verifying the username and password securely. After I check if an email address exists in the database, I check if the inputted password also matches the one in the databse, but my password is not verifying.

This is my user_login.php file:

require_once "../include/Constants.php";

$conn = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

if($_SERVER['REQUEST_METHOD']=='POST')
{
    $username = $_POST['username'];
    $password = $_POST['password'];

    //filter this variable for security

    $password = strip_tags(mysqli_real_escape_string($conn, trim($password)));

    $query = "SELECT * FROM students WHERE s_id = '".$username."' ";
    $tbl = mysqli_query($conn, $query);
    if(mysqli_num_rows($tbl)>0)
    {
        //when email is matched it also need to verify the password
        $row = mysqli_fetch_array($tbl);
        $password_hash = $row['password'];
        if(password_verify($password, $password_hash))
        {
            echo "success";
        }
        else
        {
            echo "failed login"."<br/>";
            echo $password_hash."<br/>";
            echo $password;
        }
    }
    else
    {
        echo "email failed";
    }

For some reason the password and password encrypted with bcrypt don't match. I can't find what I am doing wrong. Please help if you have some pointers on to what the solution might be. Thanks!

Upvotes: 2

Views: 213

Answers (1)

Funk Forty Niner
Funk Forty Niner

Reputation: 74217

As it stands, you would need to change mysqli_fetch_array() to
mysqli_fetch_array($tbl, MYSQLI_ASSOC), since that alone was fetching the wrong type of array.

Without a specific argument, it (mysqli_fetch_array()) defaults to MYSQLI_BOTH, being an associative and numeric array. PHP may have been trying to access the wrong associated column for it.

Upvotes: 2

Related Questions