Password_verify CodeIgniter

Question

I am using PHP in CodeIgniter. In the Registration function in Controller, I use password_hash for security. Now, I know I need to put password_verify in order to login, but I can't figure out where I am going to put and how.

    if(isset($_POST['btnRegister'])){

        $this->load->library('form_validation');

        $data['first_name'] = $this->form_validation->set_rules('first_name','First Name','required|ucwords|min_length[3]|trim|callback_alpha_dash_space');
        $data['last_name'] = $this->form_validation->set_rules('last_name','Last Name','required|ucwords|min_length[3]|trim|callback_alpha_dash_space');
        $data['gender'] = $this->form_validation->set_rules('gender','Gender','required');
        $data['email'] = $this->form_validation->set_rules('email','Email','required|valid_email');
        $data['password'] = $this->form_validation->set_rules('password', 'Password','required');
        $data['passconf'] = $this->form_validation->set_rules('passconf', 'Password Confirmation','required|min_length[5]|matches[password]');


        if($this->form_validation->run() == FALSE){

            $this->load->view('main_view', $data);
            
        }else{

            $data = array(

                'first_name' => $this->input->post('first_name'),
                'last_name' => $this->input->post('last_name'),
                'gender' => $this->input->post('gender'),
                'email' => $this->input->post('email'),
                'password' => password_hash($this->input->post('password'),PASSWORD_DEFAULT)
                
            );          

            $this->crud_model->insert($data);

            redirect(base_url() . 'main/inserted');
        }
    }else{
    $this->load->view('main_view', $data);
    }
}

I don't know if it's in the Model or in Controller

check_login in Controller:-

public function check_login(){

    $this->load->library('form_validation');

    $this->form_validation->set_rules('email', 'Email', 'required');

    $this->form_validation->set_rules('password', 'Password', 'required');

    if($this->form_validation->run()){

        $email = $this->input->post('email');

        $password = $this->input->post('password');

        $num_row = $this->crud_model->login_model($email,$password);

        if($num_row->num_rows() > 0){

            foreach($num_row->result() as $row):

                $my_id['user_id'] = $row->user_id;

            endforeach;

                    $this->session->set_userdata($my_id);

                    $user_id = $this->session->userdata('user_id');

                    redirect(base_url() . 'main/home');
        }else {

            redirect(base_url() . 'main/login' . '?email=' . md5(rand(1,1000)));
        }

    }else{

        $this->login();

    }
}

the login_model function in Model:-

function login_model($email, $password){

    $this->db->where('email', $email);

    $this->db->where('password', $password);

    $query = $this->db->get('users_tbl');

    return $query;
}

Answer 1

It solved my problem by putting it into Controller and here's the code:

public function check_login(){

    $this->load->library('form_validation');

    $this->form_validation->set_rules('email', 'Email', 'required');

    $this->form_validation->set_rules('password', 'Password', 'required');

    if($this->form_validation->run()){

        $email = $this->input->post('email');

        $password = $this->input->post('password');

        $query = $this->crud_model->login_model($email, $password);

        if($query->num_rows() > 0){

            $rowquery = $query->row();

            if (password_verify($password, $rowquery->password)){

            foreach($query->result() as $row):

                $my_id['user_id'] = $row->user_id;

            endforeach;

                    $this->session->set_userdata($my_id);

                    $user_id = $this->session->userdata('user_id');

                    redirect(base_url() . 'main/home');
            }

        }else {

            redirect(base_url() . 'main/login' . '?email=' . md5(rand(1,1000)));
        }
    
    }else{

        $this->login();

    }
}

while the login model should be this:

function login_model($email, $password){

    $this->db->where('email', $email);

    $query = $this->db->get('users_tbl');

    return $query;

}

Answer 2

Note:- What you need is to do with firstly fetch the record based on email from the DB where only the email matches (assuming it is the Unique key), after that get the hashed password from Database and compare it with the user inputted password.

Change Login Model to this:-

  public function login_model($email, $password){

        $this->db->where('email', $email);   // fetch by email first
        $query = $this->db->get(users_tbl); 
        $result = $query->row();       // get the row first
    
     if(!empty($result) && password_verify($password, $result->password)){
            // if this email exists,then the input password is verified using password_verify() function by database.
            return $result;
        } else {
            return false;
        }
    }

Please change your Controller Code to :-

$num_row = $this->crud_model->login_model($email,$password);
        if($num_row->num_rows() > 0){
            foreach($num_row->result() as $row):
                $my_id['user_id'] = $row->user_id;
            endforeach;
                    $this->session->set_userdata($my_id);
                    $user_id = $this->session->userdata('user_id');
                    redirect(base_url() . 'main/home');
        }else {
            redirect(base_url() . 'main/login' . '?email=' . md5(rand(1,1000)));
        }
    }else{
        $this->login();
    }

This:-

$admin_result = $this->crud_model->login_model($email,$password);
if ($admin_result >0){ //active user record is present
             
                 $this->session->set_userdata('admin_session',$admin_result);
                 $this->session->set_flashdata('login_message', '<div class="alert alert-success text-center">You are Successfully Login to your account!</div>');
                 redirect(base_url().'main/home');     
            }else{
            redirect(base_url() . 'main/login' . '?email=' . md5(rand(1,1000)));
        }
    }else{
        $this->login();
}