0

I am having trouble pulling back data from my DB when using a hashed password. I use hash_hmac/sha256 as follows:

function get_password_hash($password){
return hash_hmac('sha256',$password,'xxxxxxx',false);
}

$p is a non-hashed password; with this stored in my database, the below works perfectly:

$loginQuery = $dbc->prepare("SELECT id, username FROM users WHERE (email=? AND pass=?)");
$loginQuery->bind_param('ss',$e,$p);
$loginQuery->execute();
$loginQuery->bind_result($id,$username);

while($loginQuery->fetch()){
$_SESSION['user_id'] = $id;
$_SESSION['username'] = $username;
} 

If i update my database to hold the hashed password instead, and update the above to be as follows, the SQL statement brings nothing back from my database.

$pas = get_password_hash($p);
$loginQuery = $dbc->prepare("SELECT id, username FROM users WHERE (email=? AND pass=?)");
$loginQuery->bind_param('ss',$e,$pas);
$loginQuery->execute();
$loginQuery->bind_result($id,$username);

while($loginQuery->fetch()){
$_SESSION['user_id'] = $id;
$_SESSION['username'] = $username;
} 

I understand that this is because the database record holds the hashed password in a varbinary field but in my SQL query, I am using a string.

The parameter type options i can use in the prepared statement are String, Blob, Double and Integer; which of these relate to varbinary fields in my DB?

I saw a similar post which suggested a fix using pack() to convert string to binary; how would this work here?

10
  • 2
    For one, don't use mysqli_real_escape_string and parameter binding. It's either or, never both. Commented May 14, 2014 at 17:32
  • Secondly, output your $pas variable to confirm it's the same value as the hash in your database. Commented May 14, 2014 at 17:33
  • 1
    You should probably use false in your hmac to get a string result, and just use that instead of the binary encoding (which will indeed break when you use both mysqli_real_escape_string and parameter binding) Commented May 14, 2014 at 17:35
  • I removed any mysqli_real_escape_string, used false in my hmac and tested db hash versus $pas using the below. Still nothing returned from database. Commented May 14, 2014 at 17:54
  • 1
    Why are you insisting on storing the password in a VARBINARY field? When you call hash_hmac() with the fourth parameter set to false like you have it returns a regular string, not a binary string. Commented May 14, 2014 at 18:17

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.