YII2 - check user - php

Question

Okay, so, i am trying to write an API, and for the login function, you send the phone and password and if they match with a record in the database, we send back the user object.
You send phone and password via GET request, and I know what that means security wise, so don't mention that in solution.
Here is code for the API controller
<?php
namespace api\modules\v1\controllers;
use yii\rest\Controller;
use yii\data\SqlDataProvider;
use yii\web\Response;
use yii;
use common\models\User;
class UserController extends ApiController{
const STATUS_DELETED = 0;
const STATUS_ACTIVE = 10;
public $phone;
public $password;
private $_user = false;
private $password_hash;
public function actionIndex(){
if(isset($_GET['phone']) && isset($_GET['password']))
{
$this->phone = $_GET['phone'];
$this->password = $_GET['password'];
if(!is_null($this->getUser($this->phone)))
{
//if the user is there, we try and validate the password
if (Yii::$app->getSecurity()->validatePassword($this->password, $this->_user->password_hash))
{
echo ("good password");
return $this->_user;
} else
{
echo('bad password');
}
}else
{
return['User Not Found, Please Check Your Credentials And Try Again'];
}
}
else
{
if(!isset($_GET['phone']))
{
return array('Please provide your phone number');
}
if(!isset($_GET['password']))
{
return array('Please provide your password');
}
}
}
public function getUser($phone)
{
if ($this->_user === false) {
$this->_user = User::findOne(['phone' => $phone,'status' => self::STATUS_ACTIVE ]);
}
return $this->_user;
}
}
According to this section of the documentation, the validatePassword() should work, but even when i send the right password, it doesn't work.