PHP Change Account Password Brakes at verify current password - php

Question

I am trying to make a Change You Account Password Function for my website.
The login codes are working properly, hashed passwords with bcrypt , log in verifies and confirms that the account name and password are correct with the ones that are entered.
I am trying to use the same algorithm to check the Current pass and Database pass verification ,but something seems to be missing.
I constantly get a different hash from the password that is entered and respectively wrong current password error.
Here is the exact code I use in the php file.
<?php
session_start();
function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
$client_new_password_err = $client_current_password_err = $client_confirm_new_password_err = $general_err = "";
try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
// set the PDO error mode to exception
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$user_check = $_SESSION['login_user'];
$stmt = $conn->prepare("SELECT UserName FROM user_main WHERE UserName='$user_check'");
$stmt->execute();
foreach ($stmt->fetch(PDO::FETCH_ASSOC) as $arr) {
$login_session = $login_session . $arr;
}
if (empty($login_session)) {
$conn = null;
header('Location: login.php');
}
$stmt = $conn->prepare("SELECT Email FROM user_main WHERE UserName='$user_check'");
$stmt->execute();
foreach ($stmt->fetch(PDO::FETCH_ASSOC) as $arr) {
$login_email = $login_email . $arr;
}
}
catch(PDOException $e)
{
echo $stmt . "<br>" . $e->getMessage();
}
$conn = null;
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if (!empty($_POST["current-password"])) {
$client_current_password = test_input($_POST['current-password']);
$cost = [
'cost' => 11,
];
$client_current_hashed_password = password_hash($client_current_password, PASSWORD_BCRYPT, $cost);
} else {
$client_current_password_err = "No input on Current Password";
}
if (!empty($_POST['new-password'])) {
$client_new_password = test_input($_POST['new-password']);
$cost = [
'cost' => 11,
];
$client_new_hashed_password = password_hash($client_new_password, PASSWORD_BCRYPT, $cost);
} else {
$client_new_password_err = "No input on New Password";
}
if (!empty($_POST['confirm-new-password'])) {
$client_confirm_new_password = test_input($POST['confirm-new-password']);
$cost = [
'cost' => 11,
];
$client_confirm_new_hashed_password = password_hash($client_confirm_new_password, PASSWORD_BCRYPT, $cost);
} else {
$client_confirm_new_password_err = "No input on New Password";
}
if ($client_new_hashed_password == $client_confirm_new_hashed_password) {
$to_change_pass = 1; // not yet implemented
} else {
$to_change_pass = 0; // not yet implemented
}
}
if (!empty($client_current_hashed_password) && !empty($client_new_hashed_password) && !empty($client_confirm_new_hashed_password)) {
try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
// set the PDO error mode to exception
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$user_check = $_SESSION['login_user'];
$stmt = $conn->prepare("SELECT Password FROM user_main WHERE UserName='$user_check'");
$stmt->execute();
foreach ($stmt->fetch(PDO::FETCH_ASSOC) as $db_hash_pass) {
if(password_verify($client_current_password, $db_hash_pass)) {
$stmt = $conn->prepare("UPDATE user_main SET Password = '$client_new_hashed_password' WHERE UserName = '$user_check'");
} else {
$general_err = "Entered current password does not match the actual password for this account. Please try again.";
}
}
}
catch(PDOException $e)
{
echo $stmt . "<br>" . $e->getMessage();
}
$conn = null;
}
?>
The main question is how should I be checking if the inputted current pass matches the one on the database?
Should i be using the hashed version of the pass entered by the client or should i be using the plain text password?
This is the login password verify code which is 100% operational
if (!empty($_POST['password'])) {
if (!preg_match("/^[a-zA-Z0-9 ]*$/",$_POST['password'])) {
$usernameErr = 'Only Letters and Numbers';
} else {
$client_password = test_input($_POST['password']);
if(password_verify($client_password, $hashed_password)) {
$_SESSION['login_user'] = $client_username;
header("location: profile.php");
where $hashed_password is drawn from the database column Password with username match and here it works.
As you can see I have limited passwords to letters and numbers only so -
Bonus question : By allowing all characters to be used in a password , does that impose any type of injection threat?

Answer 1

Don't hash, but verify instead. – jeroen 13 mins ago
Removed hashing from the code entirely and it is ok now, it works by using password_verify($client_current_password, $db_hash_pass).
Thank you jeroen for the push u gave me to do this :D