PHP password_hash not matching [duplicate] - php

Question

This question already has answers here:
How to use PHP's password_hash to hash and verify passwords
(5 answers)
Closed 2 years ago.
I have a password being hashed and saved in to a SQL database with the following code:
$passHash = password_hash($password, PASSWORD_DEFAULT);
It is saved in to a field called 'password' with the type VARCHAR(255)
I then use the following code to log the user in
$dbconn = OpenCon();
$username = $_POST['usernameInput'];
$password = $_POST['passInput'];
$passHash = password_hash($password, PASSWORD_DEFAULT);
$school = $_POST['schoolInput'];
$sqlstmnt2 = 'SELECT * FROM users WHERE username = :username AND school = :school';
$stmtUsr2 = $dbconn -> prepare($sqlstmnt2);
$stmtUsr2 -> bindValue(':username', $username);
$stmtUsr2 -> bindValue(':school', $school);
$stmtUsr2 -> execute();
$rows = $stmtUsr2 -> fetchAll();
$n = count($rows);
if($n<1 or !password_verify($rows[0]['password'], $passhash)) {
echo 'No user account exists. Please check your credentials'."<br>";
}
else{
$_SESSION['username'] = $username;
header("Location: home.php");
}
When I run it and enter a details I know to be correct, the password_verify function is not returning that they are the same. What am I doing wrong?

Answer 1

If we break down the code, and look at the main flow without the details, we have something like this:
$passwordFromUserInput = getPasswordFromUserInput(); // $password in your code
$passHash = password_hash($passwordFromUserInput, PASSWORD_DEFAULT);
$passwordHashFromDb = getPasswordHashFromDb(); // $rows[0]['password'] in your code
if ( password_verify($passwordHashFromDb, $passHash) ) {
// success
}
(I'm assuming that although the database column is called password, it isn't actually storing the raw password, which would defeat the purpose of hashing it!)
But if we look at the signature of password_verify in the PHP manual, it looks like this:
password_verify ( string $password , string $hash )
You're passing in two hashes, but it wants a password (the one the user attempted to log in with) and a hash (the one you've stored). So the corrected version of the simplified code is this:
$passwordFromUserInput = getPasswordFromUserInput(); // $password in your code
$passwordHashFromDb = getPasswordHashFromDb(); // $rows[0]['password'] in your code
if ( password_verify($passwordFromUserInput, $passwordHashFromDb) ) {
// success
}
Or more succinctly:
if ( password_verify($_POST['passInput'], $rows[0]['password']) ) {
// success
}
The key to understanding this is that the function is not just comparing two strings. It's using information stored in the original hash (including a random "salt" string) to re-calculate a new hash from the user's input.