Changing from md5 to password_hash

Question

I was following a tutorial on creating a cms but the instructor used md5 for the passwords, I am trying to change it to use password_hash instead. The password used in my sql database does use password_hash but I am getting confused as to how to verify it in my login page.

I've tried changing the md5 to password_hash in the login page but this does not work and I've also tried password_verify. I know these should be used but can't figure out where and what I should change.

<?php

session_start();

include_once('../includes/connection.php');


if (isset($_SESSION['logged_in'])) {
    ?>
    <html>
    <head>
    <title>CMS Tutorial</title>
    <link rel="stylesheet" href="../assets/style.css"/>
    </head>

    <body>
        <div class="container">
        <a href="index.php" id="logo">CMS</a>

        <br />

        <ol>
            <li><a href="add.php">Add Article</a></li>
            <li><a href="delete.php">Delete Article</a></li>
            <li><a href="logout.php">Logout</a></li>

        </ol>


    </div>  
    </body>
</html>



    <?php

}else{
    if (isset($_POST['username'], $_POST['password'])) {
        $username = $_POST['username'];
        //$password = md5($_POST['password']);
        $password = password_hash($_POST['password'], PASSWORD_DEFAULT);

        if (empty($username) or empty($password)){
            $error = 'All fields are required!';
        }else{
            $query = $pdo->prepare("SELECT * FROM users WHERE user_name = ? AND user_password = ?");

            $query->bindValue(1, $username);
            $query->bindValue(2, $password);

            $query->execute();

            $num = $query->rowCount();

            if ($num == 1) {
                $_SESSION['logged_in'] = true;
                header('Location: index.php');
                exit();
                //user entered correct details
            }else{
                //user entered false details
                $error = 'Incorrect details!';
        }
    }
    }
    ?>

    <html>
    <head>
    <title>CMS Tutorial</title>
    <link rel="stylesheet" href="../assets/style.css"/>
    </head>

    <body>
        <div class="container">
        <a href="index.php" id="logo">CMS</a>

        <br /><br />

        <?php if (isset($error)) { ?>

        <small style="color:#aa0000"><?php echo $error; ?></small>
        <br /><br />

        <?php } ?>


        <form action="index.php" method="post" autocomplete="off">
            <input type="text" name="username" placeholder="Username" />
            <input type="password" name="password" placeholder="Password" />
            <input type="submit" value="Login" />
        </form> 
    </div>  
    </body>
<html>

    <?php
}

?>

At the moment I am just getting the

"incorrect details" error

that I have created and if I use password_verify I get the

"all fields are required error"

See [`password_verify()` in the manual](https://www.php.net/manual/en/function.password-verify.php) — RiggsFolly, Jun 11 '19 at 09:18
you present more code than related to the question core. try to pin it down to what you are asking. — 2x2p, Jun 11 '19 at 09:19

score 3 · Accepted Answer · answered Jun 11 '19 at 09:19

3

To check the password you must use password_verify() function, instead of password_hash().

Some time ago I wrote a canonical example, Authenticating a user using PDO and password_verify().

As you can see, the code is extremely simple: you just need to select the password and then compare it using password_verify()

$stmt = $pdo->prepare("SELECT * FROM users WHERE user_name = ?");
$stmt->execute([$_POST['username']]);
$user = $stmt->fetch();

if ($user && password_verify($_POST['password'], $user['password']))
{
    $_SESSION['logged_in'] = true;
    header('Location: index.php');
    exit();
}else{
    $error = 'Incorrect details!';
}

answered Jun 11 '19 at 09:19

Your Common Sense

156,878
40
214
345

hi, I tried what you've said and it comes up with "unidentified index:password" and it for the line: if ($user && password_verify($_POST['password'], $user['password'])), what could I be missing? – l15 Jun 11 '19 at 11:25
It means exactly what it says. Must be user_password as in your database. – Your Common Sense Jun 11 '19 at 11:32
Yeah that's exactly what it was, was just being stupid there, thanks a lot for your help, works perfectly now – l15 Jun 11 '19 at 11:47

Changing from md5 to password_hash

1 Answers1