1

I've a problem with my php login file. I ask the password from my db by checking the email. When I obtain this password I check it with the password the user filled in.

In the password_verify($Passwd, $row['Passwd']) the result will always return 0 but the result should be return 1 (password matches).

Why do my passwords not match with each other?

Login code:

<?php
if(isset($_POST['submit'])){

    include_once '../includes/connection.php';

    $Email = $_POST['email'];
    $Passwd = $_POST['passwd'];

    //Create Template
    $sql = "SELECT Passwd FROM user WHERE Email = ?";

    //Create Prepared Statement
    $stmt = mysqli_stmt_init($conn);

    //Prepare Prepared Statement
    if(!mysqli_stmt_prepare($stmt, $sql)){

        echo "SQL Statement Failed";

    } else {

        mysqli_stmt_bind_param($stmt, "s", $Email);

        mysqli_stmt_execute($stmt);

        $res = mysqli_stmt_get_result($stmt);
        
        while ($row = mysqli_fetch_assoc($res)){
            
            echo $Passwd . "<br>";
            echo $row['Passwd'];

            if(password_verify($Passwd, $row['Passwd'])){
                echo "1";
            } else {
                echo "0";
            }
        }

    }

} else {

    header("Location: ../index.php?login=error");
}
?>

Registration code:

<?php

if(isset($_POST['submit'])){

    include_once '../includes/connection.php';

    $Username = $_POST['username'];
    $Email = $_POST['email'];
    $Passwd = $_POST['pwd'];

    //Create Template
    $sql = "INSERT INTO user (Username, Email, Passwd)
        VALUES (?, ?, ?);";

    //Create Prepared Statement
    $stmt = mysqli_stmt_init($conn);

    //Prepare Prepared Statement
    if (!mysqli_stmt_prepare($stmt, $sql)) {

        echo "SQL Statement Failed";

    } else {

        $hashed_passwd = password_hash($Passwd, PASSWORD_DEFAULT);
        
        //Replace '?' by the acctual data
        mysqli_stmt_bind_param($stmt, "sss", $Username, $Email, $hashed_passwd);

        //Run parameters inside database
        mysqli_stmt_execute($stmt);
    }


    header("Location: ../index.php?signup=succes");

} else {

    header("Location: ./index.php?sinup=error");

}

?>

Passwd is a varchar(50) column in the database.

14
  • 1
    The code you've shown looks ok. But since we can't see what email and password you sent to the server , or what the database row containing the hashed password looks like, or how exactly you saved the password to begin with, it's hard to be sure precisely what might be going wrong.
    – ADyson
    Commented Jul 6, 2020 at 12:15
  • When the user creates an account, the password is hashed into the database with password_hash. In my code above $row['Passwd'] returns the hashed password if i echo it and if i echo $Passwd it returns the accutal password the user filled in in the form. So $row['Passwd'] is hashed from the db and $Passd is what the user filled in in the form Commented Jul 6, 2020 at 12:18
  • ok. Maybe something went wrong when the password was first saved. Can you show the all the relevant code for that?
    – ADyson
    Commented Jul 6, 2020 at 12:19
  • Where can i post my other code? Because on stackoverflow there is a time limit Commented Jul 6, 2020 at 12:21
  • 2
    Great. I wrote it up as an answer below - please mark as "accepted" and/or upvote if it's helpful. Thanks :-)
    – ADyson
    Commented Jul 6, 2020 at 12:36

1 Answer 1

2

The password_hash manual says:

it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice)

So you need to specify a minimum size of 60 characters for the password column in your database - but a larger size e.g. 255 is recommended in case the default hashing algorithm changes in future.

You'll also need to re-generate any existing passwords stored in the 50-character field, because they will have been truncated when they were saved, and the extra information has been lost, meaning those old passwords can never be verified.

Not the answer you're looking for? Browse other questions tagged or ask your own question.