PHP Verifying passwords using password_verify and password_hash

Question

I'm try to use hash from PHP to encrypt my password save to database. This is my login code:

$email=$_POST['email'];
$password=$_POST['password'];
$sql ="SELECT user_email FROM tbl_user WHERE user_email=:email ";
$query= $dbh -> prepare($sql);
$query-> bindParam(':email', $email, PDO::PARAM_STR);
$query-> execute();
$results=$query->fetchAll(PDO::FETCH_OBJ);
if($query->rowCount() > 0)
{
    if(password_verify($password, $results["user_password"]))
    {
        $_SESSION['signin']=$_POST['email'];
        $currentpage=$_SERVER['REQUEST_URI'];
        echo "<script type='text/javascript'> document.location = '$currentpage'; </script>";
    }
    else
    {
        echo "<script>alert('Invalid Details');</script>";
    }
} else{

    echo "<script>alert('Invalid Details');</script>";

}

and this is my signup code :

$user_fullname=$_POST['fullname'];
$user_email=$_POST['email'];
$user_phonenumber=$_POST['telephone'];
$hashToStoreInDb = password_hash($_POST['password'], PASSWORD_DEFAULT);
$sql="INSERT INTO  tbl_user(user_email,user_fullname,user_phonenumber,user_password) VALUES(:user_email,:user_fullname,:user_phonenumber,:hashToStoreInDb)";
$query = $dbh->prepare($sql);
$query->bindParam(':user_email',$user_email,PDO::PARAM_STR);
$query->bindParam(':user_phonenumber',$user_phonenumber,PDO::PARAM_STR);
$query->bindParam(':user_fullname',$user_fullname,PDO::PARAM_STR);
$query->bindParam(':hashToStoreInDb',$hashToStoreInDb,PDO::PARAM_STR);
$query->execute();
$lastInsertId = $dbh->lastInsertId();
if($lastInsertId)
{
    echo "<script>alert('Something went wrong. Please try again');</script>";
}
else
{
    echo "<script>alert('Registration successfully. Now you can Sign In');</script>";
}

I can signup and save the data in my database , after sign up i don't to verify password for login and i stuck at login. Please help me if i have wrong code or any suggestion code to modify my code. Thanks for help

Joseph_J · Accepted Answer · 2018-10-13 08:31:23Z

1

Your login query is not retrieving the password hash that is stored on your DB. You need to take the password hash that is on your DB and compare it to the password hash that is generated from the user's password submitted on log in. I think this should do the trick.

Change your login query to:

$sql ="SELECT user_email, user_password FROM tbl_user WHERE user_email=:email ";

Also, your query is being returned as an object. So instead of referencing $results["user_password"] you need to reference the variable like $results->user_password.

edited Oct 13, 2018 at 8:31

answered Oct 13, 2018 at 7:42

Joseph_J

3,6692 gold badges15 silver badges22 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Muhammad Wazexr Over a year ago

Ok Sir, i try change to $sql ="SELECT * FROM tbl_user WHERE user_email=:email ";

martinstoeckli Over a year ago

@MuhammadWazexr - You will run into other problems as soon as you will allow to change the email address. I would think about storing the user id in the session, instead of the email address, as another benefit the id has no case sensitivity problem.

Muhammad Wazexr Over a year ago

@martinstoeckli , can user id store in session if login using email? i try do it, but when i call name by user id. name can't preview

martinstoeckli Over a year ago

@MuhammadWazexr - You are free to store whatever you need in the session, it is easy to store the id and the username.

Muhammad Wazexr Over a year ago

@martinstoeckli Thanks for suggestion, i will try your suggestion.

Collectives™ on Stack Overflow

PHP Verifying passwords using password_verify and password_hash

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related