First row matched but other rows does not match password_verify

Question

here is the register code where i put the hash password on the database with salt.

              <?php
          include '../database/connectDB.php';

            if (isset($_POST['submit']))
{       
                $username= $_POST['leguser'] ;
                $password= $_POST['legpass'] ;  
                $options = [
                    'cost' => 11,
                    'salt' => mcrypt_create_iv(22, MCRYPT_DEV_URANDOM),
                ];
                $pwhash = password_hash($password, PASSWORD_DEFAULT, $options)."\n";

                $username = mysql_real_escape_string($username);
                $password = mysql_real_escape_string($password);

    $query = mysql_query("SELECT * FROM tbl_users WHERE fld_username = '". $username ."'"); 
                    if (mysql_num_rows($query) > 0) 
                    { 
                         echo "<script>alert('Username already used!');</script>"; }
                    else
                    {                           
     mysql_query("INSERT INTO `tbl_users`(fld_username,fld_password) 
     VALUES ('$username','$pwhash')"); 
                    }                          
}

            ?>

here is the login code where i verify the password

    <?php 
$DB_HOST = 'localhost';
$DB_USER = 'root';
$DB_PASS = '';
$DB_NAME = 'rsi_db';

$conn = new mysqli($DB_HOST, $DB_USER, $DB_PASS, $DB_NAME);
if($conn->connect_errno > 0) {
  die('Connection failed [' . $conn->connect_error . ']');
}


if (isset($_POST['submit']))
    {       
                    $username= $_POST['user'] ;
                    $password= $_POST['pass'] ; 
        $sql = "SELECT * FROM tbl_users WHERE fld_username = '$username'";
        $result = $conn->query($sql);
        if ($result->num_rows === 1) {
        $row = $result->fetch_array(MYSQLI_ASSOC);
        if (password_verify($password, $row['fld_password'])) {
        echo "Match";
        }
        else 
        {
        echo "not match";
        }                 
    }
    }
    ?>

At first i registered username = 1 and password = 1 and tried logging in and it was a match, but when i tried registering a valid user and password, it didnt match. can someone help me troubleshoot this further?

Thank You in Advance, i am a php beginner only please dont be hard :)

try var_dump($password) and var_dump($row['fld_password']) before if password_verify — Randyka Yudhistira, Jan 27 '15 at 05:40
okay here is the output of that : string(1) "1" string(61) "$2y$11$H83GgNapOdRZvmVKYtW5.OwL3P4ju/fBHz/KlMIYCr.1M1hhzJbcO " not match — Vawn Harvey Galanza, Jan 27 '15 at 05:44
i deleted the data of the table now and tried registering username = 1 and password = 1 again but now it doesnt match. :( — Vawn Harvey Galanza, Jan 27 '15 at 05:45
ups. sorry. i mean var_dump($pwhash) and var_dump($row['fld_password']) — Randyka Yudhistira, Jan 27 '15 at 05:51
i assume there's invalid length of both variable. try reading this [SO Post](http://stackoverflow.com/questions/27610403/php-password-verify-not-working-with-database) — Randyka Yudhistira, Jan 27 '15 at 05:52
Update, i limited the varchar from 255 to 60 and it all matched, so weird why do i need to limit the character to 60. — Vawn Harvey Galanza, Jan 27 '15 at 06:29

score 0 · Answer 1 · answered Jan 27 '15 at 06:40

0

there's 1 blank space in

$2y$11$H83GgNapOdRZvmVKYtW5.OwL3P4ju/fBHz/KlMIYCr.1M1hhzJbcO <-here

so if you limit it by 60, then viola. the space now gone

answered Jan 27 '15 at 06:40

Randyka Yudhistira

3,612
1
26
41

yes, i edited my code : $pwhash = password_hash($password, PASSWORD_DEFAULT, $options)."\n"; i noticed i put a ".\n" ; so it has space on the last part. – Vawn Harvey Galanza Jan 27 '15 at 06:52
no. you must do it like this `$pwhash = substr(password_hash($password, PASSWORD_DEFAULT, $options), 0, 60);` – Randyka Yudhistira Jan 27 '15 at 06:55

score 0 · Accepted Answer · answered Jan 27 '15 at 07:57

0

The trailing new line is your problem:

$pwhash = password_hash($password, PASSWORD_DEFAULT, $options)."\n";
                                                              ______

Just remove it from the line and it will save a 60 character string into your database. Another thing you should remove is the generation of the salt, the function itself will generate a safe salt for you then.

$options = ['cost' => 11];

answered Jan 27 '15 at 07:57

martinstoeckli

23,430
6
56
87

so i dont need the generation of salt anymore then? okay will remove it thanks ! :D – Vawn Harvey Galanza Jan 27 '15 at 09:43
@VawnHarveyGalanza - No the function `password_hash()` will generate its own salt. Your salt with 22 bytes (binary string) is not even valid for BCrypt, though the function will correct it. – martinstoeckli Jan 27 '15 at 10:02

First row matched but other rows does not match password_verify

2 Answers2