password_verify hash not matching password - php

Question

I have generated a password hash using the code below:
$hash = password_hash("test", PASSWORD_BCRYPT);
I then store it in the database using a 255 char.
Then I try to do the comparator to test the login and it fails. It only lets me login using a hash I have just generated a few lines before, not one stored in the database.
<?php
//Database connection
require 'database.php';
//Handle logins
if ($_POST['login'])
{
//Receive the login attempt
$login_email = $_POST['login_email'];
$login_password = $_POST['login_password'];
//Get the password hash
if ($statement = $mysqli->prepare("SELECT password FROM accounts WHERE email = ? LIMIT 1"))
{
$statement->bind_param("s", $login_email);
$statement->execute();
$statement->store_result();
//Does the account exist?
if ($statement->num_rows > 0)
{
$statement->bind_result($hash);
$statement->fetch();
//echo $login_password;
echo $hash."<br>";
//$hash = password_hash("test", PASSWORD_BCRYPT);
//echo $hash."<br>";
//Check the password hash
if (password_verify($login_password, $hash))
{
echo '<br>Password is valid!';
//Begin session
session_start();
$_SESSION["favcolor"] = "yellow";
}
else
{
echo '<br>Invalid password.';
}
}
else
{
//Account doesn't exist warning
}
$statement->free_result();
$statement->close();
}
}
//Handle new registrations
if ($_POST['register'])
{
//Receive the register attempt
$register_email = $_POST['register_email'];
$register_password_one = $_POST['register_password_one'];
$register_password_two = $_POST['register_password_two'];
//Check if email is already taken
if ($statement = $mysqli->prepare("SELECT email FROM accounts WHERE email = ? LIMIT 1"))
{
$statement->bind_param("s", $register_email);
$statement->execute();
$statement->store_result();
//Does the account exist?
if ($statement->num_rows > 0)
{
//Account already exists warning
}
else
{
//Create the account
if ($statement = $mysqli->prepare("INSERT INTO accounts (email, password) VALUES (?,?)"))
{
//Create bycrypt hash of password
$hash = password_hash($register_password_one, PASSWORD_BCRYPT);
//Insert new account
$statement->bind_param("ss", $register_email, $hash);
$statement->execute();
$account_id = $statement->insert_id;
$statement->close();
//Begin session
session_start();
$_SESSION["favcolor"] = "yellow";
}
}
$statement->free_result();
$statement->close();
}
}
//Handle logout
if ($_POST['logout'])
{
session_unset();
session_destroy();
}
?>
password hash in database: $2y$10$xDnZIjzw8h.9utp3qyRlxezPd8jmK9k6Z5JuoVtooOpkPCBd.n6W6
password hash that is just generated (works): $2y$10$tolDQdeTQrTio8IJ0Wi9AuHN5Km28pSB5kUh5qfkdkOsDXP295H1K
I am not an expert with hashing. Just trying to follow the latest recommendations. Could someone tell me why the hash is different to the one in the database?

Answer 1

the hash generated is different every time
pass plain text to the password_verify() function... see below
$originalPassword = password_hash("THE_PASSWORD", PASSWORD_DEFAULT);
// This will produce something like (taken form above)
$2y$10$tolDQdeTQrTio8IJ0Wi9AuHN5Km28pSB5kUh5qfkdkOsDXP295H1K
// When verifying this
if(password_verify("THE_PASSWORD", $passwordFromDatabase['password'])){
echo "Success";
}else{
echo "Fail";
}