Why isn't the matching of this hash happening? - php

Question

I am Using PHP version 5.4 and I have looked around for a while now for a hashing mecanism but I can't get it to work. The tricky part is validating the hashed password with another one the user tries, what am I doing wrong here?
//and yes I am using password as name in this example
$password_entered ="cucumberball";
$password_hash = crypt($password_entered);
mysql_set_charset('utf8');
pdoConnect();
//insert hashed pass (same name and pass(hashed) for user)
$stmt = $pdo->prepare("insert into user (name,password) values (:name,:password)");
$stmt->bindParam(':name', $password_entered);
$stmt->bindParam(':password', $password_hash);
$stmt->execute();
//retriving password from db and checking if its correct with the login password provided
$stmt = $pdo->prepare("select password from user where name = :name LIMIT 1;");
$stmt->bindParam(':name', $password_entered);
$stmt->execute();
$user = $stmt->fetch(PDO::FETCH_OBJ);
if(crypt($password_entered, $password_hash) == $user->password) {
// password is correct
echo "WORKS";
}else{
echo "did not work";
}

Answer 1

When you're comparing you are salting when encrypting the password and the password from the database is only encrypted.
if(crypt($password_entered, $password_hash) == $user->password) {
Also, according to the documentation you should be comparing like this
You should pass the entire results of crypt() as the salt for
comparing a password, to avoid problems when different hashing
algorithms are used. (As it says above, standard DES-based password
hashing uses a 2-character salt, but MD5-based hashing uses 12.)
if (hash_equals($hashed_password, crypt($user_input, $hashed_password))) {
echo "Password verified!";

Answer 2

Fix this if statement:
if(hash_equals(crypt($password_entered, $password_hash), $password_hash))
{
echo "WORKS";
}
Or as there is no hash_equals in PHP 5.4:
if(crypt($password_entered, $password_hash) == $password_hash)
{
echo "WORKS";
}
But without hash_equals, your hashes are vulnerable to timing attack.
Also you may want to read this manual.