How to check if a User already exists in a MySQL database and if the password matches stored hashed password

Question

I am trying to login users with ID number and password. I have tried to write the code for my login system. The problem is that I have signed up 2 users and know the ID number and password then I put in correct values for password and ID and still get error messages. I set the ID number of one of my users to 123456789, when I enter that number in the ID number field it still shows invalid User ID. The password is hashed using BCRYPT and stored. I tried to match that as well but that also is not matching when I enter the same password into the password field.

There is also the error message: "mysqli_num_rows() expects parameter 1 to be mysqli_result, bool given in C:\Users.... on line 25" when I run the code

I looked at example code here on stackoverflow,youTube and through Google but I can't seem to figure the problem with this code.


    <?php
    session_start();

    //variables to store errors initialized to empty string
    $id_error=$pwd_error="";
    //initialize variables
    $ID_Number= $password="";


    if (isset($_POST["login"])) 
    { // if submit (login) button is pressed(clicked)--

            require_once("DBconnection.php"); //require connection to database
            $password=$_POST["password"];
            $ID_Number =  htmlspecialchars($_POST["id_Number"]);

            if(empty($_POST["id_Number"])) //if the ID number field is empty 
                {
                    $id_error="Please enter your ID number"; //error message
                }
            else
            {
                    $sql_chk="SELECT * FROM 'users_information' WHERE UserID ='$ID_Number';"; //look for 
             //ID number in database. There should be 1 row 
                    $result_chk= mysqli_query($conn,$sql_chk); //result of query
                if(mysqli_num_rows($result_chk)>0) // if there is a row
                {
                    while ($row = mysqli_fetch_assoc($result_chk)) //returns row as associated array

                    {   // check if password matches database password
                        if(password_verify($password,$row["User_Password"])==True)
                        {
                        $_SESSION['user']= $ID_Number;
                        $_SESSION['correct_password']="correct password";
                        header("location: profile.php");
                        }
                        else
                        {
                            $pwd_error="invalid password";
                        }
                    }
                }
                else
                {
                    $id_error = "Invalid User ID";
                }
            }
        print_r($_POST);
        mysqli_close($conn); // close connection        
    } 
    ?>
    ```

Good, then if you're hashing them correctly, using `password_hash()` your column is large enough. — Jay Blanchard, Jan 15 '20 at 17:47
You should not have to check the number of rows, you can just check `$result` — Jay Blanchard, Jan 15 '20 at 17:49
the password is hashed in the signup form. I can't match two hash directly because BCRYPT uses a different salt each time to hash password so I am trying to use password_verify() function — user7843250, Jan 15 '20 at 18:00
@Jay Blanchard I am checking the number of rows to see if a user exist with that ID — user7843250, Jan 15 '20 at 18:01
Are you using `password_hash()`? If not `password_verify()` *will not work* — Jay Blanchard, Jan 15 '20 at 18:01
I don't have to use password_hash() again.That was used in the signup form. in the password_verify() function for the parameter where we have to put the hashed password I am trying to access that particular field value from the database and from the row value $row["User_Password"] — user7843250, Jan 15 '20 at 18:07
I don't know how to use prepared statement properly yet so later I might adjust the code so it is safe from SQL injection — user7843250, Jan 15 '20 at 18:09
Since your query is failing, you might want to learn it now. Besides, if you develop an unsafe authentication system people will not use it. — Jay Blanchard, Jan 15 '20 at 18:15

How to check if a User already exists in a MySQL database and if the password matches stored hashed password

0 Answers0