How to compare Laravel's hash password using a custom login form?

Question

Can you help me with this? I am building my own login form using Laravel. But I have a problem because I stored my password using Hash method and in my login form I used hash method again to compare. But I found out that the hash value is always changing.

Here's my code in routes:

Route::post('/admin_handle_login', function()
{

    $rules = array(
        'admin_username'    =>  'required',
        'admin_password'    =>  'required'
    );

    $validate_admin_login = Validator::make(Input::all(), $rules);

    if($validate_admin_login->fails()) {

        $messages = $validate_admin_login->messages();

        Session::flash('warning_notification','Error: Incomplete details!');

        return Redirect::to('/flaxadmin')
                            ->withErrors($messages)
                            ->withInput(Input::except('admin_password'));

    } else {

        $d = array(
            Input::get('admin_username'), Hash::make(Input::get('admin_password'))
        );

        $validate_admin = DB::table('administrators')
                            ->select('username')
                            ->where('username', Input::get('admin_username'))
                            ->where('password', Hash::check('password', Input::get('admin_password')))
                            ->count();
        fp($d);
        fp($validate_admin);

    }

});

The result is

Array
(
    [0] => admin002
    [1] => $2y$10$RTwKHN9W1/unu1ZhYlNjauApJjjoNTBnE6td/AZ5jWgZEdqVav0um
)
0

In my database the password of admin002 is

$2y$10$47sSXLzh/YXN6Rf2fmljYO7lZaxfhXVSUTp5bssR2gYQ6Nw9luUH2

Is my code wrong? Or are there any proper way to do this? I am a begiiner in Laravel..

What you will have to do is find all users in the database with this username. Then you will have to check the password for each of the accounts. — Jerodev
– Jerodev, Commented Oct 30, 2014 at 8:31
I know that. But I used hashed function and it always changing whenever the page is reloaded or refresh. So if I use 123 as a password and in my database is 123 also but they are different hash value. That's why I can't get the exact value — Jerielle
– Jerielle, Commented Oct 30, 2014 at 8:38

Marcin Nabiałek · Accepted Answer · 2014-10-30 08:48:10Z

21

First, you cannot do it this way. Assuming username is unique, you should do:

$validate_admin = DB::table('administrators')
                            ->select('username')
                            ->where('username', Input::get('admin_username'))
                            ->first();

if ($validate_admin && Hash::check(Input::get('admin_password'), $validate_admin->password)) {
  // here you know data is valid
}

However you should think about rather using built-in methods than coding it yourself. You have Auth::attempt or Auth::validate if you want to login/check only user with password so there's really no need to code it yourself.

answered Oct 30, 2014 at 8:48

Marcin Nabiałek

112k43 gold badges271 silver badges299 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Daniel Gelling Over a year ago

What'll happen if no user exists?

Marcin Nabiałek Over a year ago

@DanielGelling I've added $validate_admin && at the beginning of if statement

Jerielle Over a year ago

Ok I already used the model USER but I don't know how to change or overwrite the table inside the model USER. What I know is the Auth::validate is using the User model class. I used this in my customer account and it is working so I decided to create another login for my admin account

Marcin Nabiałek Over a year ago

@Jerielle So you could probably look also at stackoverflow.com/questions/18785754/…

Daniel Gelling · Accepted Answer · 2020-03-18 10:56:06Z

4

Here you're checking the string 'password' with the hashed version of the input password.

So try fetching the user by their username and if you've a result you can compare the hashed version of the password, stored in the database, with the input password. Like so:

$user = DB::table('administrators')
        ->select('username', 'password')
        ->where('username', Input::get('admin_username');

if($user->count()) {
    $user = $user->first();
    if(Hash::check(Input::get('admin_password'), $user->password)) {
         //User has provided valid credentials :)
    }
}

edited Mar 18, 2020 at 10:56

answered Oct 30, 2014 at 8:48

Daniel Gelling

9301 gold badge9 silver badges25 bronze badges

2 Comments

ayyanar pms Over a year ago

i don't know how this answer got up votes, IF condition is wrong, it should be Hash::check(Input::get('admin_password'),$user->password)

Daniel Gelling Over a year ago

@ayyanarpms You are correct, there is (was) a missing bracket...

bmatovu · Accepted Answer · 2018-07-08 16:08:36Z

2

A slight improvement to marcin-nabiałek's answer, you can now use PHP's password_verify to achieve the same

$user = App\User::where('email', $request->email)->first();

if($user && password_verify($request->password, $user->password)) {
   // authenticated user,
   // do something...
}

answered Jul 8, 2018 at 16:08

bmatovu

4,1341 gold badge41 silver badges41 bronze badges

Comments

icalvete · Accepted Answer · 2021-06-17 02:12:37Z

-1

This is useful code 100% laravel 6/7/8.

if ($data = AddEmployee::where('name', $request->name)-first()) {
  $pass = Hash::check($request->password, $data->password);
  if ($pass) {
    echo "sucess";
  } else {
    echo "Password Not Valid";
  }
} else {
  echo "Username Not Valid" . "<br>";
}

edited Jun 17, 2021 at 2:12

icalvete

1,1593 gold badges24 silver badges57 bronze badges

answered Jun 16, 2021 at 8:31

Axay Patanvadiya

364 bronze badges

Collectives™ on Stack Overflow

How to compare Laravel's hash password using a custom login form?

4 Answers 4

4 Comments

2 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

4 Comments

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related