Excuting invalid password line even if the match in database - php

Question

In the below code i am entering the correct username and password, but what is happening the its collecting the values from the form and when he reach to line 28 (if (password_verify($password, $row['cpass'])) {) its jumping to line 33 ($password_error = "Invalid password.";) even if the values entered is matching what in the database
<?php
session_start();
require_once 'dbconn.php'; // assume this file sets up $conn PDO object
$username = "";
$password = "";
$username_error = "";
$password_error = "";
$login_error = "";
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
$username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_FULL_SPECIAL_CHARS);
$password = filter_input(INPUT_POST, 'password', FILTER_SANITIZE_FULL_SPECIAL_CHARS);
// Check clients table
$stmt = $pdo->prepare('SELECT COUNT(*) FROM clients WHERE cuid = :username');
$stmt->bindParam(':username', $username);
$stmt->execute();
$count = $stmt->fetchColumn();
if ($count == 1) {
// Check password
$stmt = $pdo->prepare('SELECT cpass FROM clients WHERE cuid = :username');
$stmt->bindParam(':username', $username);
$stmt->execute();
$row = $stmt->fetch();
if (password_verify($password, $row['cpass'])) {
$_SESSION['username'] = $username;
header('Location: dashboard.html');
exit;
} else {
$password_error = "Invalid password.";
}
}
// If the "Remember Me" checkbox is checked
if (isset($_POST['checkbox'])) {
setcookie('username', $username, time() + (30 * 24 * 60 * 60)); // 30 days expiration
setcookie('password', $password, time() + (30 * 24 * 60 * 60)); // 30 days expiration
}
}
?>
Is there any explanation for what is happening, I tried to delete the table in the database and re-create it and then enter the data, but the problem was not resolvedز

Answer 1

You shouldn't apply the FILTER_SANITIZE_FULL_SPECIAL_CHARS on the password as that will rewrite certain characters (e.g. < will be replaced with <). Just retrieve the raw submitted password with $password = $_POST['password']