Cannot verify password in PHP

Question

On this project, I've used BCRYPT to make a hash off the password

On logging in, the user normally logging in without any errors or whatsoever, but when trying to change your password, your current password does not match with the password in the database (of course i'm using password_verify() to verify the two passwords)

Here is the snippet of my code:

  $option = ['cost' => 12];
  $password = password_hash($_currentpassword, PASSWORD_BCRYPT, $option);

  $selectpasswordsql = "SELECT `password` FROM `auth` WHERE username=?";
  $selectpasswordstmt = $conn->prepare($selectpasswordsql);
  $selectpasswordstmt->execute(array($_SESSION['account']['username']));
  $selectpasswordresults = $selectpasswordstmt->fetch(PDO::FETCH_ASSOC);

  $databasepass = $selectpasswordresults['password'];
  $databasepass = trim($databasepass);
  if(password_verify($password,$databasepass)){
    if(empty($passmsgs)){
      $updatepasssql = "UPDATE `auth` SET
        `password`=?
      WHERE username=?
      ";
      $updatepassstmt = $conn->prepare($updatepasssql);
      $updatepassstmt->execute(array($password, $_SESSION['account']['username']));
      if($updatepassstmt){
        array_push($passmsgs, 'Successfully updating your password!');
      } else {
        array_push($passmsgs, 'There was a problem executing your command!');
      }
    }
  } else {
    array_push($passmsgs, 'Your current password is wrong!');
  }

Trying this out will cause an error of not matching your current password with the password

Edit: Yes I am using VARCHAR with a maximum length of 255

Edit 2: Here is a link to the full copy of my codes.

lol what is this · Accepted Answer · 2017-02-11 21:45:50Z

3

You don't need to hash your $_currentpassword variable in the second line.

Just pass the variable to the password_verify function and the function itself will do the job.

edited Feb 11, 2017 at 21:45

lol what is this

1402 silver badges5 bronze badges

answered Feb 11, 2017 at 15:48

Ataur Rahman

1,8311 gold badge16 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

astronomicalXoom Over a year ago

password_verify will hash my current_password so indeed it is needed. Why do you think tho that it is not needed?

astronomicalXoom Over a year ago

I added a link to see my whole codes, check it if you need to

Ataur Rahman Over a year ago

password_varify does what it needs to do, it doesn't require to hash password externally. Just pass user submitted password and old password from DB, it should work. for more : password_varify

Funk Forty Niner Over a year ago

500....... why? the manual suggests 255 is a good bet; never will password_hash produce anything beyond 255.

astronomicalXoom Over a year ago

Thanks! As far as i'm concern about efficiency, varchar(255) is the best for low consuming space

|

Collectives™ on Stack Overflow

Cannot verify password in PHP

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related