PDO Prepared statements and password hashing? - php

Question

ive looked all over the internet to try to solve this problem and i cant find figure it out for the life of me. Really starting to give up.
So basically whenever i login with the correct email and correct password it says incorrect email or password. This only happens whenever i hash the password in the db
Email: test#gmail.com
Password: testtest
Hash: $2y$10$hk3d/GyYvImcxYR.vdC2/.JDIeQeXyKdTSPifueAkQNrYVBcMn1Yi
Anyways if someone could help me that would be amazing here is my login.php code.
<?php
require "../private/php/autoload.php";
$error = "";
if($_SERVER['REQUEST_METHOD'] == "POST" && isset($_SESSION['token']) && isset($_POST['token']) && $_SESSION['token'] == $_POST['token']){
$email = $_POST['email'];
if(!preg_match("/^[\w\-]+#[\w\-]+.[\w\-]+$/", $email)){
$error = "Please enter a valid email.";
}
$password = $_POST['password'];
if ($error == ""){
$arr['email'] = $email;
$arr['password'] = $password;
$query = "SELECT * FROM users WHERE email = :email && password = :password LIMIT 1";
$stm = $conn->prepare($query);
$check = $stm->execute($arr);
if($check){
$data = $stm->fetchAll(PDO::FETCH_OBJ);
if(is_array($data) && count($data) > 0){
$data = $data[0];
if (password_verify($_POST['password'], $data->password)){
$_SESSION['username'] = $data->username;
$_SESSION['user_id'] = $data->user_id;
header("Location: index.php");
die;
}
}
}
}
$error = "Wrong email or password!";
}
$_SESSION['token'] = get_random_string(30);
?>```

Answer 1

Your MySQL table contains the password hashed, but you're querying it passing through the un-hashed password which is why it's not matching/working presently.
Also, worth noting that this could be bad from a security point of view as the plaintext password is being transmitted and could easily end up in your MySQL logs (Slow Log, Error if there was any issue etc.).
Swap the query out to just look up on the email address alone (assuming it's unique), and then verify the password hashes match in your PHP logic against the MySQL result.