Error with a authentication script. Password not recognize - php

Question

I'm building a restricted area but I have some problems with password authentication. The system doesn't recognize the password stored into database
step by step. New user:
$userName = $_POST['txtUserName'];
$password = $_POST['txtPassword'];
$sql = "INSERT INTO tbl_user (user_name, user_password, user_regdate)
VALUES ('$userName', PASSWORD('$password'), NOW())";
This works. I have a new user stored into database
Database: MySQL V5.6
`user_id` int(10) unsigned NOT NULL AUTO_INCREMENT,
`user_name` varchar(20) NOT NULL DEFAULT '',
`user_password` varchar(32) NOT NULL DEFAULT '',
ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=11 ;
So I try to login (from login form):
// if we found an error save the error message in this variable
$errorMessage = '';
$userName = $_POST['txtUserName'];
$password = $_POST['txtPassword'];
// first, make sure the username & password are not empty
if ($userName == '') {
$errorMessage = 'You must enter your User Name';
} else if ($password == '') {
$errorMessage = 'You must enter your password';
} else {
// check the database and see if the username and password combo do match
$sql = "SELECT user_id
FROM tbl_user
WHERE user_name = '$userName' AND user_password = PASSWORD('$password')";
$result = dbQuery($sql);
if (dbNumRows($result) == 1) {
$row = dbFetchAssoc($result);
$_SESSION['plaincart_user_id'] = $row['user_id'];
// log the time when the user last login
$sql = "UPDATE tbl_user
SET user_last_login = NOW()
WHERE user_id = '{$row['user_id']}'";
dbQuery($sql);
// now that the user is verified we move on to the next page
// if the user had been in the admin pages before we move to
// the last page visited
if (isset($_SESSION['login_return_url'])) {
header('Location: ' . $_SESSION['login_return_url']);
exit;
} else {
header('Location: index.php');
exit;
}
} else {
$errorMessage = 'Username or password wrong';
}
}
return $errorMessage;
}
It seems that doesn't recognize the password function (), because if I write manually in the database password fiels a value not encrypted, it works...

Answer 1

You're using MySQL's PASSWORD function for a use it's not intended for. Aside from being a horrible idea from a security standpoint (plaintext passwords can end up in the logs), it also means that MySQL will silently truncate the password if the password field isn't long enough for it. This will results in password hashes that can never match.
You need to look into password hashing to make your passwords more secure and less prone to truncation errors (DO NOT USE MD5 OR SHA-1 FOR THIS! Even SHA-256 is dubious). You also need to determine how long a hash string will be for the method you've chosen and make sure the password field is big enough to take it.
http://php.net/manual/en/book.password.php