password_verify() does not match with password in database - php

Question

I am creating a user login page. I used password($pass,PASSWORD_BCRYPT) in inserting the data into the database but on trying to verify the password with password_verify($password,$salt) the values does not match.
I am sure that the data $salt retrieved from the database is correct but it does not match. Can you advise how I can troubleshoot it further? I have searched this thoroughly but cant find any answer.
This is my login code below:
<?php
// if form submitted
// check supplied login credentials
// against database
}
else { $username = $_POST['username'];
$password = $_POST['password'];
// check input
if (empty($username)) {
die('ERROR: Please enter your username');
}
if (empty($password)) {
die('ERROR: Please enter your password');
}
// attempt database connection
include("memberconnect.php");
$pdo = new mysqli($host,$user,$password,$database);
if (!$pdo) {
die("ERROR: Could not connect: (" . $pdo->errno .")" .$pdo->error);
}
// escape special characters in input
$username = stripslashes($username);
// check if usernames exists
$sql = "SELECT Login_Name FROM memberdirectory WHERE Login_Name = '$username ' ";
if ($result = mysqli_query($pdo,$sql)) {
$row = mysqli_num_rows($result);
// if yes, fetch the encrypted password
if ($row == 1) {
$sql = "SELECT Password FROM memberdirectory WHERE Login_Name = '$username' ";
// encrypt the password entered into the form
// test it against the encrypted password stored in the database
// if the two match, the password is correct
if ($result = mysqli_query($pdo,$sql)) {
$row = mysqli_fetch_array($result);
$salt = $row[0];
if (password_verify($password,$salt))
{
// password correct
// start a new session
// save the username to the session
// if required, set a cookie with the username
// redirect the browser to the main application page
session_start();
$_SESSION['username'] = $username;
if ($_POST['sticky']) {
setcookie('name', $_POST['username'], mktime()+86400);
}
header('Location: main.php');
}
else
{ echo 'You entered an incorrect password.';
echo strlen($salt);
var_dump(password_verify('$password',$salt));
var_dump($salt);
}
}
else {
die("ERROR: Could not execute $sql (" .$pdo->errno.")".$pdo->error);
}
} else {
echo 'You entered an incorrect username.';
}
} else {
die( "ERROR: Could not execute $sql (" .$pdo->errno.")".$pdo->error);
}
// close connection
unset($pdo); }
?>

Answer 1

password_verify checks the password against a hash. To get the hash, which by the looks would be saved to the database, you would use password_hash. This is even stated in password_verify php.net manual pages. Please recheck your hashing.
The only password function I am aware of is for MySQL that is used mainly for MySQL authentication. If you are using a custom function password, you will have to resend the entered password and salt through or reverse engineer the hash.