0

Hello I'm trying to implement a login system with Unity, however I seem to be having a problem with my PHP.

I think I have narrowed the problem down to the hash being retrieved from the database incorrectly. I suspect this is the problem because if I hardcode the correct hash into a variable and use password_verify() it works, however the same hash when retrieved from the database will not verify.

Thanks in advance for any help.

Here is my register.php script:

<?php

    $conn = mysqli_connect("localhost", "root", "root", "MultiplayerExperience");

    $username = $_POST["usernamePost"];
    $password = $_POST["passwordPost"];

    if(mysqli_connect_errno())
    {
        echo("Connection failed");
        exit();
    }

    $userCheckQuery = "SELECT username FROM players WHERE username = '".$username."';";
    $userCheck = mysqli_query($conn, $userCheckQuery);

    if(mysqli_num_rows($userCheck) > 0)
    {
        echo("User already exists");
        exit();
    }

    $hashedPassword = password_hash(trim($password), PASSWORD_BCRYPT);

    $userInsertionQuery = "INSERT INTO players (username, hash) VALUES ('".$username."', '".$hashedPassword."' );";
    $userInsertion = mysqli_query($conn, $userInsertionQuery) or die("User insertion failed");

    echo("RegistrationSuccess");

?>

Here is my login.php script
<?php

    $conn = mysqli_connect("localhost", "root", "root", "MultiplayerExperience");

    $username = $_POST['usernamePost'];
    $password = $_POST['passwordPost'];

    if(mysqli_connect_errno())
    {
        echo("Connection failed");
        exit();
    }

    $nameCheckQuery = "SELECT username FROM players WHERE username = '".$username."';";
    $nameCheck = mysqli_query($conn, $nameCheckQuery);

    if(mysqli_num_rows($nameCheck) != 1)
    {
        echo("User not found");
        exit();
    }

    $hashFetchQuery = "SELECT hash FROM players WHERE username = '".$username."';";
    $hashFetch = mysqli_query($conn, $hashFetchQuery);

    $correctHash = '$2y$10$qeInE4VYnGiHRiivh/5z8OpX65NrWPYA6/UZTH2HIEGPV6gr9rNZ2';  //Correct hash copied from database
    $incorrectHash = '$2y$10$qeInP4YYnGiHRiivh/5z8OpX63NrWPYO6/UZTH2HIEGPV6gr9rNZ2';    //Incorrect hash for testing

    if(password_verify(trim($password), trim($hashFetch)))
    {
        echo("LoginSuccess");
        exit();
    }

    echo("Incorrect password");


?>

I have searched google for a few days and every post about this matter will not resolve my issue.

Soner Gönül
  • 97,193
  • 102
  • 206
  • 364
Kurtis
  • 61
  • 1
  • 4

0 Answers0