PHP hashing prob

Question

I am doing a Registration / Login and I can't get hashed passwords to match.

if(isset($_POST["pass"])) {
  $pass = $_POST["pass"];
  $options = array('cost' => 11);
  $pass = password_hash("$pass", PASSWORD_BCRYPT, $options)."\n";    
} 

$sql2 = $db->prepare('INSERT INTO Registrace (Email, Password, Nick) VALUES (:email, :password, :nick)');
$sql2->execute(array(':email' => $email,':password' => $pass, ':nick' => $nick));

Hashed password has been entered in Database.

Now, how do I make the password in login match the one in databse?

if(isset($_POST["pass"])) {
  ? ? ? ? ?     
}



$sql = $db->prepare("SELECT Nick,Password FROM registrace WHERE Nick=:nick AND Password=:password");
    $sql->bindParam(':nick', $_POST['lognick']);
    $sql->bindParam(':password', $pass);
    $sql->execute();

    if($row = $sql->fetch()){
        $_SESSION['lognick'] = $row['lognick'];
        $_SESSION['lognick'] = $_POST["lognick"];
        $_SESSION['time'] = time();
        header("Location: Logged.php");
}
else {
  $_SESSION['error'] .= "Pass and Nick don't match.  ";
  header("Location: Login.php");   
}

Any idea what to do ?

Don't limit passwords and use the proper methods to hash passwords with PHP. — Jay Blanchard
– Jay Blanchard, Commented Jun 4, 2015 at 20:23

Machavity · Accepted Answer · 2015-06-04 20:27:54Z

4

What you'll need to do is find the username in the database and retrieve the hash, then pass it to password_verify

$sql = $db->prepare("SELECT Nick,Password FROM registrace WHERE Nick=:nick");
// PDO binds and execute here
if($row = $sql->fetch()) {
     if(!password_verify($_POST['password'], $row['Password']) { //login fail

answered Jun 4, 2015 at 20:27

Machavity♦

31.8k27 gold badges97 silver badges108 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Tomaso Albinoni · Accepted Answer · 2015-06-04 20:33:12Z

0

Look up the password hash and then check the entered password as follows:

if (password_verify($_POST['pass'], $row['Password'])) {
    // Logged in
} else {
    // Wrong password
}

edited Jun 4, 2015 at 20:33

answered Jun 4, 2015 at 20:27

Tomaso Albinoni

1,0131 gold badge8 silver badges20 bronze badges

Collectives™ on Stack Overflow

PHP hashing prob

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related