This question already has answers here:
What is the difference between single-quoted and double-quoted strings in PHP?
(7 answers)
Closed 6 years ago.
i'm working on a passowrd reset but the issue i'm having is that when ever the password is about to get update for some reason it changes here is my code
>?php
if ($password == $confirmpassword)
{
echo "$password";
echo "</br>";
//has and secure the password
$npassword = password_hash('$password', PASSWORD_BCRYPT, array('cost' => 10));
echo "$npassword";
// Update the user's password
$query = $conn->prepare('UPDATE users SET password = :password WHERE email = :email');
$query->bindParam(':password', $npassword);
$query->bindParam(':email', $email);
$query->execute();
$conn = null;
echo "Your password has been successfully reset.";
}
else
echo "Your password's do not match.";
}
?>
example im trying to use demo123 as password when i echo $password i do get demo123, when i echo $npassword i get a code and when i manually do
>?php $npassword = password_hash('demo123', PASSWORD_BCRYPT, array('cost' => 10));?>
i get another hash Now this has does work if i add it manually if i use the variable $password i get another code wrong by the way cause i cant login but if i do it manual and update it then demo123 works.
what am i doing wrong, I'm a newbie
If you want to use variables in strings you have to use double-quotes (").
In your case though, since you're using variables exlusively and not adding anything to them, you can just remove your quotes:
$npassword = password_hash($password, PASSWORD_BCRYPT, array('cost' => 10));
Also, since cost already defaults to 10 you can just omit that aswell:
$npassword = password_hash($password, PASSWORD_BCRYPT);
password_hash results are always different, you can't query mysql by generated hash, you need to get the user and do password_verify ($password, $hash); instead
where $password is 'demo123' and $hash is password column value from DB
Related
This question already has answers here:
How to use PHP's password_hash to hash and verify passwords
(5 answers)
Closed 2 years ago.
I have a password being hashed and saved in to a SQL database with the following code:
$passHash = password_hash($password, PASSWORD_DEFAULT);
It is saved in to a field called 'password' with the type VARCHAR(255)
I then use the following code to log the user in
$dbconn = OpenCon();
$username = $_POST['usernameInput'];
$password = $_POST['passInput'];
$passHash = password_hash($password, PASSWORD_DEFAULT);
$school = $_POST['schoolInput'];
$sqlstmnt2 = 'SELECT * FROM users WHERE username = :username AND school = :school';
$stmtUsr2 = $dbconn -> prepare($sqlstmnt2);
$stmtUsr2 -> bindValue(':username', $username);
$stmtUsr2 -> bindValue(':school', $school);
$stmtUsr2 -> execute();
$rows = $stmtUsr2 -> fetchAll();
$n = count($rows);
if($n<1 or !password_verify($rows[0]['password'], $passhash)) {
echo 'No user account exists. Please check your credentials'."<br>";
}
else{
$_SESSION['username'] = $username;
header("Location: home.php");
}
When I run it and enter a details I know to be correct, the password_verify function is not returning that they are the same. What am I doing wrong?
If we break down the code, and look at the main flow without the details, we have something like this:
$passwordFromUserInput = getPasswordFromUserInput(); // $password in your code
$passHash = password_hash($passwordFromUserInput, PASSWORD_DEFAULT);
$passwordHashFromDb = getPasswordHashFromDb(); // $rows[0]['password'] in your code
if ( password_verify($passwordHashFromDb, $passHash) ) {
// success
}
(I'm assuming that although the database column is called password, it isn't actually storing the raw password, which would defeat the purpose of hashing it!)
But if we look at the signature of password_verify in the PHP manual, it looks like this:
password_verify ( string $password , string $hash )
You're passing in two hashes, but it wants a password (the one the user attempted to log in with) and a hash (the one you've stored). So the corrected version of the simplified code is this:
$passwordFromUserInput = getPasswordFromUserInput(); // $password in your code
$passwordHashFromDb = getPasswordHashFromDb(); // $rows[0]['password'] in your code
if ( password_verify($passwordFromUserInput, $passwordHashFromDb) ) {
// success
}
Or more succinctly:
if ( password_verify($_POST['passInput'], $rows[0]['password']) ) {
// success
}
The key to understanding this is that the function is not just comparing two strings. It's using information stored in the original hash (including a random "salt" string) to re-calculate a new hash from the user's input.
This question already has answers here:
How to use PHP's password_hash to hash and verify passwords
(5 answers)
Closed 3 years ago.
I'm creating a site where a user can login. When they make an account, I save the hashed password in the database. I am trying to user password_verify() in order to confirm the password matches, but it returns false.
To confirm that they match, I print out both the hashed version of what the user typed in and the hashed password that is stored in the database.
I know a common problem is that the database password field is too small for the hashed password, but I have tried setting it as both VARCHAR(256) and TEXT to make sure the entire hashed password is stored.
if(isset($_POST['email'])){
$email = strip_tags(mysqli_real_escape_string($conn, $_POST['email']));
$password = strip_tags(mysqli_real_escape_string($conn, $_POST['passwd']));
$sql = "SELECT email, passwd AS hashed_password FROM Accounts WHERE email = '$email'";
$result = $conn->query($sql);
$row = mysqli_fetch_array($result,MYSQLI_ASSOC);
//print the hashed password that is stored in the database
echo 'stored in the database: '. $row['hashed_password']. '<br>';
$hash = hash('sha512', $password);
//print the hashed version of what the user typed in
echo 'hashed version of what your submitted: '. $hash. '<br>';
if( password_verify($password, $hash)){
echo "true";
}
else{
echo 'false';
}
I expect that password_verify() returns true but it returns false
Here is what i have it currently outputting:
stored in the database:
1f40fc92da241694750979ee6cf582f2d5d7d28e18335de05abc54d0560e0f5302860c652bf08d560252aa5e74210546f369fbbbce8c12cfc7957b2652fe9a75
hashed version of what your submitted:
1f40fc92da241694750979ee6cf582f2d5d7d28e18335de05abc54d0560e0f5302860c652bf08d560252aa5e74210546f369fbbbce8c12cfc7957b2652fe9a75
false
password_verify() works with the function password_hash();
change:
$hash = hash('sha512', $password);
to:
$hash = password_hash($password, PASSWORD_DEFAULT);
I'm trying to me a page more secure and I started with the password encrypting part of it. I'm trying to implement password_hash + password verify, but so far I've been unsuccessful to make the whole thing work. So, here it is in my login area:
$username = mysqli_real_escape_string($connection, $_POST['username']);
$password = mysqli_real_escape_string($connection, $_POST['password']);
$query = "SELECT username, password FROM `users` WHERE username='$username' and user_enabled='1'";
$result = mysqli_query($connection, $query) or die(mysqli_error($connection));
if($row = mysqli_fetch_assoc($result)) { $dbpassword = $row['password']; }
if(password_verify($password, $dbpassword)) {
echo "Successful login";
}else{
echo "Invalid Login Credentials.";
}
I always get Invalid Login Credentials.
When I modify the new password for the user, I am doing the following:
$pass = mysqli_real_escape_string($connection, $_POST['password']);
$options = [ 'cost' => 10,
'salt' => mcrypt_create_iv(22, MCRYPT_DEV_URANDOM),
];
$password = password_hash($pass, PASSWORD_BCRYPT, $options)."\n";
$query = "UPDATE users
SET `password` = '".$password."'
WHERE id = ".$_POST['user_id']."
";
$result = mysqli_query($connection, $query) or die(mysqli_error($connection));
password in database is VARCHAR(255), and it is storing something like:
$2y$10$Y5HIyAsLMfkXIFSJONPsfO3Gxx3b46H.8/WFdLVH3Fqk2XNfy2Uaq
What am I doing wrong here?
The \n in the following line, is embedding a linebreak, (Edit: one that cannot be included in the user inputted password).
$password = password_hash($pass, PASSWORD_BCRYPT, $options)."\n";
and you need to delete it and start over with a new hash.
Jay Blanchard, a member here on Stack submitted a note about it not too long also in the password_hash() manual, which is something that he and I actually talked about.
Be care when using the example from the documentation which concatenates a newline character \n to the end of the hash, i.e.:
echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT)."\n";
People are storing the hash with the concatenated newline and consequently password_verify() will fail.
Another option would be to use trim(); that also works (at the moment of hashing).
$password = password_hash($pass, PASSWORD_BCRYPT, $options)."\n";
$password = trim($password);
// Store in db after
Yet you still need to start over by clearing the old hash(es) and creating new ones.
Do keep in mind though, that you shouldn't escape passwords.
One such as 123'\abc (being perfectly valid) will be modified to 123\'\abc by real_escape_string(); it's not needed. password_verify() takes care of that, security-wise.
This question already has answers here:
Using PHP 5.5's password_hash and password_verify function
(4 answers)
Closed 3 years ago.
I am trying to process a password as md5 into the database, this is the concerned code:
include_once("config.php");
session_start();
if(isset($_POST['signup'])){
$name = $_POST['name'];
$email = $_POST['email'];
$pass = $_POST['pass'];
$insert = $pdo->prepare("INSERT INTO users (name,email,pass)
values(:name,:email,:pass) ");
$insert->bindParam(':name',$name);
$insert->bindParam(':email',$email);
$insert->bindParam(':pass',$pass);
$insert->execute();
}elseif(isset($_POST['signin'])){
$email = $_POST['email'];
$pass = $_POST['pass'];
$select = $pdo->prepare("SELECT * FROM users WHERE email='$email' and pass='$pass'");
$select->setFetchMode();
$select->execute();
$data=$select->fetch();
if($data['email']!=$email and $data['pass']!=$pass) {
echo "invalid email or pass";
}
elseif($data['email']==$email and $data['pass']==$pass) {
$_SESSION['email']=$data['email'];
$_SESSION['name']=$data['name'];
header("location:profile.php");
}
}
What length in the db would be appropriate to store this hashed password?
And how do I use this:
$hashed_password = password_hash($pass, PASSWORD_DEFAULT);
var_dump($hashed_password);
and the if statement if the password was ok?
Its really quite simple once you read the manual or see an example in a tutorial. See comments in the code for details
<?php
include_once("config.php");
session_start();
if(isset($_POST['signup'])){
$name = $_POST['name'];
$email = $_POST['email'];
// at signup you hash the user provided password
$pass = password_hash($_POST['pass'], PASSWORD_DEFAULT);
$insert = $pdo->prepare("INSERT INTO users (name,email,pass)
values(:name,:email,:pass) ");
$insert->bindParam(':name',$name);
$insert->bindParam(':email',$email);
$insert->bindParam(':pass',$pass); // this stores the hashed password
$insert->execute();
}elseif(isset($_POST['signin'])){
$email = $_POST['email'];
$pass = $_POST['pass'];
// as the password on the DB is hashed you cannot use the
// plain text password in the SELECT here as it wont match
$select = $pdo->prepare("SELECT * FROM users WHERE email=:email");
// no idea what this was doing
//$select->setFetchMode();
$select->bindParam(':email',$email);
$select->execute();
$row = $select->fetch(PDO::FETCH_ASSOC);
// verify the plain text password against the
// hashed value from DB in $row['pass']
if( password_verify($pass, $row['pass']) ){
$_SESSION['email'] = $data['email'];
$_SESSION['name'] = $data['name'];
header("location:profile.php");
exit;
} else {
echo "invalid email or pass";
}
}
And as to the length of the column in the database that you need to hold this hashed value, it is documented in the manual
The following algorithms are currently supported:
PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). Note that this constant is designed to change over time as new and stronger algorithms are added to PHP. For that reason, the length of the result from using this identifier can change over time. Therefore, it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice).
PASSWORD_BCRYPT - Use the CRYPT_BLOWFISH algorithm to create the hash. This will produce a standard crypt() compatible hash using the "$2y$" identifier. The result will always be a 60 character string, or FALSE on failure.
I think i have hashed password using function PASSWORD directly from mysql database(am i doing wrong here?). And i am trying to verify that password with this code:
if($submit)
{
$first=$_POST['first'];
$password=$_POST['password'];
$hash="*85955899FF0A8CDC2CC36745267ABA38EAD1D28"; //this is the hashed password i got by using function PASSWORD in database
$password=password_verify($password,$hash);
$db = new mysqli("localhost", "root","","learndb");
$sql = "select * from admin where username = '" . $first . "' and password = '". $password . "'";
$result = $db->query($sql);
$result=mysqli_num_rows($result);
if($result>0)
{
session_start();
$_SESSION['logged_in'] = true;
session_regenerate_id(true);
header("Location:loginhome.php");
}
}
But the password is not matching. What am i missing here?
UPDATE:
After all the suggestions i have used password_hash from php code to store into database.
$db = new mysqli("localhost", "root","","learndb");
$password=password_hash('ChRisJoRdAn123',PASSWORD_DEFAULT);
$sql="INSERT INTO admin (username,password)values('ChrisJordan','$password')";
$db->query($sql);
still the password is not matching.
One cannot search for a salted password hash in a database. To calculate the hash you need the password_hash() function as you already did correctly in your insert statement.
// Hash a new password for storing in the database.
// The function automatically generates a cryptographically safe salt.
$hashToStoreInDb = password_hash($password, PASSWORD_DEFAULT);
To check a password, you first need to search by username only (used a prepared query to avoid sql injection):
$sql = 'select * from admin where username = ?';
$db->prepare($sql);
$db->bind_param('s', $first);
When you finally got the stored hash from the database, it can be checked like this:
// Check if the hash of the entered login password, matches the stored hash.
// The salt and the cost factor will be extracted from $existingHashFromDb.
$isPasswordCorrect = password_verify($password, $existingHashFromDb);
password_verify is a boolean function which return either true or false. In your code, after getting value of password from Post param, you doing this operation
$password=password_verify($password,$hash);
which changes the $password value to true or false and that boolean value stored in $password you are using in mysql select statement
$sql = "select * from admin where username = '" . $first . "' and password = '". $password . "'";
Another thing is it might be possible that the hashed/salted password you are using is not the correct hashed value of the password you are using.
Update: Try this
$cost = [
'cost' => 15,
];
$hash_password = password_hash('ChRisJoRdAn123', PASSWORD_BCRYPT, $cost);
before any db operation, change your password field varchar length to >=64
$sql = "INSERT INTO admin (username,password)values('ChrisJordan','".$hash_password."')";
After insert operation, execute the select statement with the user
$sql = "select * from admin where username = 'ChrisJordan'";
after this fetching hased password and password from the post parameter, you will need to verify both passwords using password_verify
if (password_verify(validate($_POST['password']), $hash_password_from_db)) {
echo "Valid Password";
}else{
echo "Invalid Password";
}
You must use password_hash to encode passwords verified with password_verify.
The MySQL function PASSWORD is something entirely different. It is used for encoding passwords specific to MySQL authentication. (MySQL specifically recommends against using PASSWORD for anything other than MySQL authentication.)
The two use different hashing algorithms, present their output in different formats, and are generally not compatible with each other.
The typical way to use password_hash and password_verify is:
$hash = password_hash($password, PASSWORD_DEFAULT);
//Store $hash in your database as the user's password
//To verify:
//Retrieve $hash from the database, given a username
$valid = password_validate($password, $hash);
The problem in your code is that you're doing this:
$password=password_verify($password,$hash);
$sql = "select * from admin where username = '" . $first . "' and password = '". $password . "'";
password_verify returns a boolean (whether the password and hash matched). Instead, you need to retrieve the hash from the database and match the entered password with that hash.
This is too long for a comment.
Seeing that this question has yet to contain a green tick next to any of the answers, am submitting the following in order to point out probable issues.
I noticed that you are trying to move over from MD5 to password_hash() - password_verify().
Your other question Switching from md5 to password_hash
What you need to know is that MD5 produces a 32 character length string, as opposed to password_hash() being a 60 length.
Use varchar(255).
If you kept your password column's length to 32, then you will need to clear out your existing hashes from that column, then ALTER your column to be 60, or 255 as the manual suggests you do.
You will need to clear out all your existing passwords, ALTER your column, create a new hash, then try your login code again.
I see this in your code:
"*85955899FF0A8CDC2CC36745267ABA38EAD1D28"; //this is the hashed password i got by using function PASSWORD in database
This string *85955899FF0A8CDC2CC36745267ABA38EAD1D28 is 40 long, which is too short and has been cut off.
This tells me that your column's length is 40, instead of 60, or again as the manual suggests, 255.
MD5 reference:
http://php.net/manual/en/function.md5.php
Returns the hash as a 32-character hexadecimal number.
Reference for password_hash():
http://php.net/manual/en/function.password-hash.php
The result will always be a 60 character string, or FALSE on failure.
To ALTER your column, here is a reference link:
http://dev.mysql.com/doc/refman/5.7/en/alter-table.html
Also make sure that your form contains a POST method and that the inputs bear the matching name attributes and that no whitespace gets introduced.
You can use trim() to get rid of those.
Add error reporting to the top of your file(s) which will help find errors.
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
// Then the rest of your code
Sidenote: Displaying errors should only be done in staging, and never production.
as well as or die(mysqli_error($db)) to mysqli_query().
Edit:
What you need to do is fetch an array and get the match on that.
$sql = "select * from admin where username = '".$first."' and password = '".$password."' ";
$result = $db->query($sql);
if ($result->num_rows === 1) {
$row = $result->fetch_array(MYSQLI_ASSOC);
if (password_verify($password, $row['password'])) {
//Password matches, so create the session
// $_SESSION['user']['user_id'] = $row['user_id'];
// header("Location:/members");
echo "Match";
}else{
echo "The username or password do not match";
}
}
Another possible solution:
$query = "SELECT * from admin WHERE username='$first'";
$result = $db->query($query);
if($result->num_rows ===1){
$row = $result->fetch_array(MYSQLI_ASSOC);
if (password_verify($password, $row['password'])){
echo "match";
} else {
$error = "email or Password is invalid";
echo $error;
}
}
mysqli_close($db); // Closing Connection