Verifying and creating hashed password error, I can create an account with hashed password, however, I cannot verify it?

Question

<?php
require "Common.php";
$player_username = $_POST ["usernamePost"];
$player_password = $_POST ["passwordPost"];
$hashed_password = password_hash($player_password, PASSWORD_DEFAULT);

$conn = new mysqli ($server_host, $server_username, $server_password, $server_dbName);

$result = mysqli_query ($conn, "SELECT * FROM users WHERE Username ='$player_username' and Password = ''");
$count = mysqli_num_rows($result);

if ($count == 1) {
    while ($row = mysqli_fetch_assoc ($result)) {
        if (password_verify($player_password, $hashed_password)) {
            echo "Signing in...<br>";
            echo "ID:".$row ['ID'] . "|Username:".$row ['Username'] . "|Score:".$row ['Score'] . "|Status:".$row ['Status'];
        }
    }
}
else {
    echo "Incorrect username or password.";
}
?>

Second piece of code:

<?php
require "Common.php";
$player_username = $_POST ["usernamePost"];
$player_password = $_POST ["passwordPost"];
$hashed_password = password_hash($player_password, PASSWORD_DEFAULT);

$conn = new mysqli ($server_host, $server_username, $server_password, $server_dbName);
    $queryCode = "SELECT * FROM users WHERE Username = '$player_username'";
    $query = mysqli_query ($conn, $queryCode);
    if (mysqli_num_rows($query) > 0) {
        echo "Username already exists.";
    } else {
        $sql = "INSERT INTO users (Username, Password)
        VALUES ('".$player_username."','".$hashed_password."')";
        $result = mysqli_query ($conn,$sql);
        echo "User created.";
    }
?>

I can create an account with a hashed password, however, I cannot login with it. I've looked at every post regarding my issue on this website. It's either that I was looking at the wrong thread or I simply did not understand what they were doing.

Answer 1

You cannot verify a hashed password because you're select a user having a blank password:

$result = mysqli_query ($conn, "SELECT * FROM users WHERE Username ='$player_username' and Password = ''");

Remove the password test from your query:

<?php
require "Common.php";
$player_username = $_POST ["usernamePost"];
$player_password = $_POST ["passwordPost"];
$hashed_password = password_hash($player_password, PASSWORD_DEFAULT);

$conn = new mysqli ($server_host, $server_username, $server_password, $server_dbName);

$result = mysqli_query ($conn, "SELECT * FROM users WHERE Username ='$player_username'");
$count = mysqli_num_rows($result);

if ($count == 1) {
    $row = mysqli_fetch_assoc ($result);
    if (password_verify($player_password, $row['hashed_password'])) {
        echo "Signing in...<br>";
        echo "ID:".$row ['ID'] . "|Username:".$row ['Username'] . "|Score:".$row ['Score'] . "|Status:".$row ['Status'];
    }
}  else {
    echo "Incorrect username or password.";
}

Since you're only returning one row you have too much code. No need for a while loop and you have to test against the password stored in the database $row['hashed_password'].

---

In addition:

Little Bobby says your script is at risk for SQL Injection Attacks. Learn about prepared statements for MySQLi. Even escaping the string is not safe! Don't believe it?

EDIT: Here is an example using a prepared statement and proper error checking:

require "Common.php";
$player_username = $_POST ["usernamePost"];
$player_password = $_POST ["passwordPost"];

$conn = new mysqli($server_host, $server_username, $server_password, $server_dbName);

/* check connection */
if (mysqli_connect_errno()) {
    echo "Connect failed: ", mysqli_connect_error());
    exit();
}

 $stmt = $conn->prepare("SELECT * FROM users WHERE Username =?"); // prepare with a placeholder for the variable
 $stmt->bind_param('s', $player_username); // bind the variable
 $stmt->execute(); // execute the query
 $row = $stmt->fetch_assoc(); // get the associative array
 if (password_verify($player_password, $row['hashed_password'])) {
     echo "Signing in...<br>";
     echo "ID:".$row ['ID'] . "|Username:".$row ['Username'] . "|Score:".$row ['Score'] . "|Status:".$row ['Status'];
 } else {
    echo "Incorrect username or password.";
}

Keep in mind that there are a couple of methods for coding and executing prepared statements. Use the method you're most comfortable with.

From Proper Password Preparation with PHP

The password_hash() can generate some very lengthy text (the current default is 60 characters), so making the field larger now will allow for the length needed. Secondly the PHP team is adding more algorithms to the method which means the hash can and will grow. We also do not want to limit our user's ability to use the password or passphrase of their choice. It's best to leave room for the changes.

Set the password field in your database to be large, for example

`password` text DEFAULT NULL