Trouble in verifying hash password with the password user entered - php

Question

i am trying to verify hash password stored in database with the password user enters to login. But i am unsuccessful with it. I am using password_verify to compare the passwords but its not giving the answer true even if i am entering correct password.
Please help me!!
<?php
print_r($_POST);
include('connect.php');
var_dump($_POST);
print_r($_POST);
$tbl_name = 'userC';
if(isset($_POST["USERNAME"]) && isset($_POST["USER_PASSWORD"]))
{
$username1 = $_POST["USERNAME"];
$password1 = $_POST["USER_PASSWORD"];
}
// To protect MySQL injection
$username1 = stripslashes($username1);
$password1 = stripslashes($password1);
$stid = oci_parse($conn, "SELECT * FROM $tbl_name where
user_name='$username1'");
$result = oci_execute($stid);
//$re = oci_fetch_all($stid,$abc);
while(($row = oci_fetch_array($stid,OCI_BOTH)) != false )
{
$password = $row[6];
$username = $row[2];
$re = 1;
}
if(isset($password))
{
if (password_verify($password1, $password))
{
$re1=1;
}
else
{
$re1 = 0;
}
}
else
{
$re1 = 0;
}
// If result matched $username and $password, table row must be 1 row
if($re >= 1 && $re1 >= 1)
{
// Register $username, $password and redirect to file "login_success.php"
session_start();
$_SESSION["username"] = $username;
header("location:form.php");
}
if($re < 1) {
$failed = 1;
header("location:login.php?msg=failed");
}
if($re1 < 1) {
$failed = 1;
header("location:verify.php?msg1=failed");
}
?>

Answer 1

Remove the $password1 = stripslashes($password1); from your code. You shouldn't modify the entered password in any way before passing it to password_verify (or password_hash for the same matter).
By the way, stripslashes isn't protecting you from SQL-injection. Use prepared statements and oci_bind_by_name instead:
$stid = oci_parse($conn, "SELECT * FROM $tbl_name where user_name=:uname");
oci_bind_by_name($stid, ":uname", $username1);
$result = oci_execute($stid);