Encrypted password :$2y$10 and $2y$13 - php

Question

I have a php(symphony) web application and an android application which access to the same database.The password field in the table is encrypted with symphony with Bcrypt and its value started with $2y$13,I used this code php to encrypt my password entered by the android application:
if(isset($_POST['password'])){
$password = $_POST['password'];
$pas_hash= password_hash("$password", PASSWORD_BCRYPT);
$sql = 'SELECT * FROM tbl_auth WHERE password = :pas_hash';
$stmt = $conn->prepare($sql);
$stmt->bindParam(':pas_hash', $pas_hash, PDO::PARAM_STR);
$stmt->execute();
if($stmt->rowCount())
{
$result="true";
}
elseif(!$stmt->rowCount())
{
$result="false";
}
// send result back to android
echo $result;
}
The problem is that the value of pas_hash started with $2y$10 and when I used password_verify(), this function returns true result.
I didn't what's the problem because the final $result sent to my android application was false.
Thanks.

Answer 1

Okay, so if($stmt->rowCount()) is checking if the amount of rows is null or not, but it is not null, it is 0 because your result returned 0 rows.
Change your statement to if ($stmt->rowCount() > 0) and that should fix it.
Personally the way you are verifying your user(?) is a bit odd, it would be better to search the person's username, get their password from the database and use password_verify on the password you got from the user and the password you got from the database. This may not suit your functionality but it might aswell so take inspiration from the code below if you wish.
Example:
if(isset($_POST['username'])){
$username = $_POST['username'] // Or however you get the username.
$password = $_POST['password'];
$sql = 'SELECT * FROM tbl_auth WHERE username = :username';
$stmt = $conn->prepare($sql);
$stmt->bindParam(':username', $username, PDO::PARAM_STR);
$stmt->execute();
$result = $stmt->fetch(PDO::FETCH_ASSOC);
if(password_verify($password, $result['password'])
{
$result="true";
}
else
{
$result="false";
}
// send result back to android
echo $result;
}