different value when retrieving data from database - php

Question

i am a beginner in PHP & MySQL development, I am following a tutorial. I am trying to make login system, after inserting data to Mysql in registration. I want to validate the password from the database and the password from user in login page, if it is match, then login is successful.
here is the password from the database, as we can see, for username=admin the password is 3462623.....
The data type of this database is like this
as we can see, the data type for password and salt is Binary.
when I tried to var_dump the variable which stores the value from the database, the password and salt is different from what appears in the database.
the password should be : 3462623.....
but from var_dump, the password is : 4bb5d8229634bf5 .....
other data like id,username,email are correct. just password and salt are different.
I suspect this is because the return value data type from var_dump is String, but when i stored to database, the datatype is Binary, how do I fix that ? it seems that from tutorial I saw, the login system still OK even though the password in string data type.
to be honest I don't understand why it has to be Binary data type. but I guess it because it will be encrypted.
so what went wrong in here?
here is the code :
Registration Process
$username = htmlentities($_REQUEST["username"]);
$password = htmlentities($_REQUEST["password"]);
$fullname = htmlentities($_REQUEST["fullname"]);
$email = htmlentities($_REQUEST["email"]);
if (empty($username) || empty($password) || empty($fullname) || empty($email)) {
$returnArray = [
"status" => "400",
"message" => "missing required information"
];
echo json_encode($returnArray);
return;
}
//encrypt the password
$salt=openssl_random_pseudo_bytes(20);
$securedPassword = sha1($password.$salt);
// Create Connection
$file = parse_ini_file("../../../twitter.ini");
$dbhost = trim($file["host"]);
$dbusername = trim($file["username"]);
$dbpassword = trim($file["password"]);
$dbname = trim($file["dbname"]);
$access = new access($dbhost,$dbusername,$dbpassword,$dbname);
$access->connect();
function registerUser($username,$password,$salt,$email,$fullname) {
$query = "INSERT INTO users SET username=?, password=?,salt=?,email=?,fullname=?";
$statement = $this->conn->prepare($query);
if (!$statement) {
throw new Exception($statement->error);
}
$statement-> bind_param('sssss',$username,$password,$salt,$email,$fullname);
$returnValue = $statement -> execute();
return $returnValue;
}
// Insert data to database
$result = $access->registerUser($username,$securedPassword,$salt,$email,$fullname);
if ($result) {
// get data from database
$user = $access->selectUser($username);
$resultArray = [
"status" => "200",
"message" => "Sucessfully registered",
"id" => $user["id"],
"username" => $user["username"],
"email" => $user["email"],
"avatar" => $user["avatar"],
"fullname" => $user["fullname"]
];
login process
$username = htmlentities($_REQUEST["username"]);
$password = htmlentities($_REQUEST["password"]);
if (empty($username) || empty($password)) {
$returnArray = [
"status" => "400",
"message" => "missing required information"
];
echo json_encode($returnArray);
return;
}
// make connection
$file = parse_ini_file("../../../twitter.ini");
$dbhost = trim($file["host"]);
$dbusername = trim($file["username"]);
$dbpassword = trim($file["password"]);
$dbname = trim($file["dbname"]);
$access = new access($dbhost,$dbusername,$dbpassword,$dbname);
$access->connect();
$user = $access -> getUserData($username);
if (empty($user)) {
$returnArray = [
"status" => "403",
"message" => "User is not found"
];
echo json_encode($returnArray);
return;
} else {
// password validation
$securedPassword = $user["password"];
$salt = $user["salt"];
if ($securedPassword === sha1($password.$salt)) {
$resultArray = [
"status" => "200",
"message" => "Login Success!",
"id" => $user["id"],
"username" => $user["username"],
"email" => $user["email"],
"avatar" => $user["avatar"],
"fullname" => $user["fullname"]
];
} else {
$returnArray = [
"status" => "403",
"message" => "Password didn't match"
];
}
}
$access ->disconnect();
echo json_encode($returnArray);

Answer 1

As pointed out by other users, password and salt should be char or varchar or even text, but not binary.
The reason you see a difference between them is based on the method of access and character sets used in retrieval and display.
In one case you are retrieving using PHP and then displaying using (likely) a PRE tag and showing it on a web page. In the other case you are viewing it in phpMyAdmin or some other MySQL desk system. Each one of these requires several translations before viewing and as binary data they will not display the same way reliably when retrieved with two different pathways (phpMyAdmin will translate the character set differently, and then display the result differently).
A simple solution to this is to switch to a non-binary (TEXT/VARCHAR) field definition.
Alternately, you could attempt to retrieve them as HEX or some other Binary Friendly display method in both your MySQL desk (using a query, not just displaying in the table) and in the php/mysqli query as well. In essence, then, you'd be converting the binary to a known text display set.