Verify password hash using password_verify and MySQL

Question

I'm trying to store an encrypted password in MySQL and as for the register part it works as it should how ever when i try to do the login things go south.

I can not verify $_POST['password'] against the hash stored in MySQL. I have no idea what I'm doing wrong.

Here is my register.php which works as it should:

register.php (working)

$post_password = mysqli_real_escape_string($_POST['password']);
$password_hash = password_hash($post_password, PASSWORD_BCRYPT);
mysqli_query goes here...

login.php (not working)

$con = mysqli_connect("XXX","XXX","XXX","XXX");
$post_username = mysqli_real_escape_string($con,$_POST['username']);
$post_password = mysqli_real_escape_string($con,$_POST['password']);

// Getting the stored Hash Password from MySQL
$getHash = mysqli_fetch_assoc(mysqli_query($con, "SELECT * FROM anvandare WHERE username = '$post_username'"));
$got_Hash = $getHash['password'];

// Checking if what the user typed in matches the Hash stored in MySQL
// **This is where it all goes wrong**
if (password_verify($post_password, $got_Hash)) {
echo "The posted password matches the hashed one";
}
else {
echo "The posted password does not match the hashed one";
}

When I run the code above I get the "Correct password" message by just entering the username and leaving the password field out.

What am I missing?

Your are not converting the newly entered password at the time of login into hash for comparing, like you did when storing them, — Purushottam zende
– Purushottam zende, Commented Feb 4, 2015 at 10:26
did you try mysqli_fetch_array?? plus do convert your password by password_hash() — habib ul haq
– habib ul haq, Commented Feb 4, 2015 at 10:28
@habibulhaq is right it happens to everyone. will write it as a answer. — Purushottam zende
– Purushottam zende, Commented Feb 4, 2015 at 10:57
mysqli_real_escape_string is for making a string safe for inserting into a database. It is not for making a string safe for running through a hashing function. — Quentin
– Quentin, Commented Feb 4, 2015 at 10:58

SuperBiasedMan · Accepted Answer · 2015-08-24 09:24:55Z

2

Actually you need to make sure that you are allowing more than 100 characters in your password column so that all the hashed password can be saved in the field. This was also happening with me, the script was correct and everything was working fine but the only mistake I was doing was that I didn't allow more than 40 characters in the password field which was the biggest error. After incrementing the maximum limit from 40 to 100, everything is working fine:)

edited Aug 24, 2015 at 9:24

SuperBiasedMan

10k11 gold badges52 silver badges76 bronze badges

answered Aug 24, 2015 at 9:21

Husnain Abbas

1691 gold badge2 silver badges10 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Verify password hash using password_verify and MySQL

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related