0

I am trying to verify the hashed password in my database using the password_verify() function but it doesn't seem to be working. Any help please.

<?php
include("config.php");
include("vendor/password.php");

session_start();

if ($_SERVER["REQUEST_METHOD"] == "POST") {

  $username = mysqli_real_escape_string($db , $_POST['umail']);
  $password = mysqli_real_escape_string($db , $_POST['upassword']);

  $userQuery = "SELECT username, password FROM users WHERE username = '$username' AND password='$password'";
  $result    = mysqli_query($db ,$userQuery);
  $queryRow  = mysqli_fetch_array($result , MYSQLI_ASSOC);
  $queryCount = mysqli_num_rows($result);


  $verifyPassowrd = password_verify($_POST['upassword'] , $queryRow[2]);

  if ($verifyPassowrd){
    header("Location:home.php"); 
  }else{
    echo  "Username Or Password is invalid";
  }
  mysqli_close($db);
}
 ?>
mymiracl
  • 583
  • 1
  • 16
  • 24
dela
  • 27
  • 6
  • 2
    Make sure you ***[don't escape passwords](http://stackoverflow.com/q/36628418/1011527)*** or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. – Jay Blanchard Jan 24 '17 at 14:34
  • [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)*** Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! [Don't believe it?](http://stackoverflow.com/q/38297105/1011527) – Jay Blanchard Jan 24 '17 at 14:34
  • 1
    The `password_hash()` function can generate some very lengthy text (the current default is 60 characters), so making the database field as large as possible now will allow for the length needed. Secondly the PHP team is adding more algorithms to the method which means the hash can and will grow. We also do not want to limit our user's ability to use the password or passphrase of their choice. It's best to leave room for the changes. – Jay Blanchard Jan 24 '17 at 14:35
  • Show us how you save the hashed password and the table definition where you save the hash. – Jay Blanchard Jan 24 '17 at 14:35
  • Don't escape the password.... I once struggled with that for sometime. until I set the password as varchar(255) in my db – Masivuye Cokile Jan 24 '17 at 14:37
  • In addition to the above: Don't use the password in the `WHERE` part of the query, if it is hashed it will never match so you will never have any results. Also note that unless you store the results of a successful login action, it will not persist so `home.php` will not know that the user has logged in. – jeroen Jan 24 '17 at 14:42
  • Thanks very much @Jay Blanchard for all the advice, i really appreciate it since i am new to programming and php itself. – dela Jan 24 '17 at 14:52
  • @MasivuyeCokile Thanks very much. :) – dela Jan 24 '17 at 15:22
  • @jeroen thanks very much – dela Jan 24 '17 at 15:23

1 Answers1

1

Your password is hashed in your database.
In your query you include a non-hashed password, so the results of the query will be an empty set.

No need to have the password in the WHERE clause of your query, because you want to check the returned hash in the password_verify function.

Updated snippet (I also fixed the typo's):

<?php
include("config.php");
include("vendor/password.php");

session_start();

if ($_SERVER["REQUEST_METHOD"] == "POST") {

  $username = mysqli_real_escape_string($db , $_POST['umail']);

  $userQuery = "SELECT username, password FROM users WHERE username = '$username'";
  $result    = mysqli_query($db, $userQuery);
  $queryRow  = mysqli_fetch_array($result, MYSQLI_ASSOC);
  $queryCount = mysqli_num_rows($result);


  $verifyPassword = password_verify($_POST['upassword'], $queryRow['password']);

  if ($verifyPassword){
    header("Location:home.php"); 
  }else{
    echo  "Username Or Password is invalid";
  }
  mysqli_close($db);
}
?>
Blaatpraat
  • 2,829
  • 11
  • 23
  • thanks very much @Blaatpraat it worked perfectly. thanks for the extra advice as well. I just started learning php. – dela Jan 24 '17 at 14:51
  • @dela no problem, that's what SO is for. I also recommend that you take the advice of the given comments also seriously. Especially the comment on SQL injections. :) – Blaatpraat Jan 24 '17 at 14:52