Blowfish password_verify doesn't do the job - php

Question

I'm hashing my passwords with blowfish using Anthony Ferrara's password compactibility library. When I hash 'em they're good, BUT when I try to verify the passwords, doing this:
public function Login($username, $postpassword) {
$stmt = $this->mysqli->prepare("SELECT username, password FROM users WHERE username=? AND password=?");
$stmt->bind_param('ss', $username, $password);
$stmt->execute();
$stmt->bind_result($username, $password);
$stmt->store_result();
if($stmt->num_rows == 1) {
while($stmt->fetch()) {
if (password_verify($postpassword, $password)) {
$SESSID = $this->newSession($username);
$_SESSION['admin_user'] = $username;
$_SESSION['last_login'] = time();
header("Location: home.php?SESSID=$SESSID");
exit();
}
}
}
else {
header("Location: index.php?e=false");
exit();
}
$stmt->close();
$stmt->free_result();
}
It tells me that me details are wrong... And YES, i did define the $username and $password:
if(isset($_REQUEST['login'])) {
$username = $_POST['username'];
$postpassword = $_POST['password'];
$users->Login($username, $postpassword);
}
Does anybody see the mistake I made?

Answer 1

You are selecting the user from the database where the username matches the entered username and the password hash matches the entered plaintext password. Of course this will never match anything. You will have to select the username and password from the database only based on the username, then verify the password using password_verify.