How do I upload a hashed password to my database? - php

Question

I have a basic login page that uses this PHP code to upload directly to my database. When I use this code it works fine and it uploads everything to my table:
$fname = $_POST['fname'];
$lname = $_POST['lname'];
$Email = $_POST['Email'];
$username = $_POST['username'];
$password = ($_POST['password']);
$PhoneNumber = ($_POST['PhoneNumber']);
$query = $con-> prepare("
INSERT INTO Users (fName, lName,Email, username, pass_word,PhoneNumber)
VALUES (:fname, :lname, :Email, :username,:password, :PhoneNumber)
");
$success = $query-> execute ([
'fname' => $fname,
'lname' => $lname,
'Email' => $Email,
'username' => $username,
'password' => $password,
'PhoneNumber' => $PhoneNumber
]);
But when i add the hash password function it just doesnt upload anything to the database at all.
$fname = $_POST['fname'];
$lname = $_POST['lname'];
$Email = $_POST['Email'];
$username = $_POST['username'];
$password = ($_POST['password']);
$PhoneNumber = ($_POST['PhoneNumber']);
$hashed_password = password_hash($password, PASSWORD_DEFAULT);
$query = $con-> prepare("
INSERT INTO Users (fName, lName,Email, username, pass_word,PhoneNumber)
VALUES (:fname, :lname, :Email, :username,:password, :PhoneNumber)
");
$success = $query-> execute ([
'fname' => $fname,
'lname' => $lname,
'Email' => $Email,
'username' => $username,
'password' => $hashed_password,
'PhoneNumber' => $PhoneNumber
]);
Update:
I made the changes that were suggested but I am still having the same issue. This is my updated code:
$password = $_POST['password'];
$hashed_password = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 15]);
$query = $con-> prepare("
INSERT INTO Users (fName, lName,Email, username, pass_word,PhoneNumber)
VALUES (:fname, :lname, :Email, :username,:password, :PhoneNumber)
");
$success = $query-> execute ([
'fname' => $fname,
'lname' => $lname,
'Email' => $Email,
'username' => $username,
'password' => $hashed_password,
'PhoneNumber' => $PhoneNumber
]);

Answer 1

1:
$hashed_password = password_hash($hashed_password, PASSWORD_DEFAULT);
You are hashing an empty string.
You should be hashing the variable containing the password:
$hashed_password = password_hash($_POST['password'], PASSWORD_DEFAULT);
2:
Your SQL query should not contain any variables, this is bad practise and potentially unsafe (for other non-hashed variables).
VALUES (:fname, :lname, :Email, :username,$hashed_password, :PhoneNumber)
But you have $hashed_password as a hardcoded variable. This is incorrect on a syntax level and will cause SQL errors as it's not encased in quotes.
You need to set this value in the ->execute as you do with all the other variables:
$query = $con-> prepare("
INSERT INTO Users (fName, lName,Email, username, pass_word,PhoneNumber)
VALUES (:fname, :lname, :Email, :username, :pwd, :PhoneNumber)
");
$success = $query-> execute ([
'fname' => $fname,
'lname' => $lname,
'Email' => $Email,
'username' => $username,
'pwd' => $hashed_password,
'PhoneNumber' => $PhoneNumber
]);
SECURITY NOTES:
A:
You are not setting a cost value on your PASSWORD_DEFAULT (at time of writing this is BCRYPT) hashing mechanism. It is STRONGLY ENCOURAGED that you set this cost value to as high as possible, rather than the default of 10.
I would suggest setting the cost value to at least 15, and reading the PHP Manual Page, which also sets out how to find the ideal cost value of your server.
$hashed_password = password_hash($password, PASSWORD_BCRYPT, ['cost' => 15]);
B:
I would also highly recommend using one of the ARGON password hashing mechanisms. You will need to recompile PHP with this enabled. I'm sure this will be made easier in coming PHP versions.
C:
I would also highly recommend ensuring your MySQL collations and character sets are UTF8mb4_ prefixed unicode: UTF8mb4_unicode_ci with respect to your password storage column/table (Also ensure your column is long enough*).
* that's what she said!