PHP Password_verify always showing false

Viewed 37

I know that theres been multiple questions asked in regards to PHP password_verify, however I did not see any answers that applied or worked in my situation.

I am storing a password in my database with the following code

$pwhash = password_hash("test123",PASSWORD_DEFAULT);
$sql = "INSERT INTO creds (Username, Password, IsAdmin) VALUES('mtpotts','$pwhash' , 1)";
$conn->exec($sql);

Which will store for example "$2y$10$CfV8ZZZLWtfADpmgOg4d5OUw56sEHo2EF5pQr33jTEZdPj9LZXUkG"

Running that through a character counter I get 60 letters. If I check the data base I have "$2y$10$CfV8ZZZLWtfADpmgOg4d5OUw56sEHo2EF5pQr33jTEZdPj9LZXUkG" So I can see that the database isn't setup too small to hold the 60 characters.

On my login page I have the following code

$user = htmlspecialchars($_POST["fname"] ?? "", ENT_QUOTES);
$plaintextpass = htmlspecialchars($_POST['pword'] ?? "", ENT_QUOTES);
try {
$conn = new PDO("mysql:host=$servername;dbname=Username", $username,$password);

$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
echo "<br>Connected<br>";
} catch (PDOException $e) {
    echo "Connection failed" . $e->getMessage();
}
$query1 = "SELECT * FROM creds WHERE username='$user'";
$stmt= $conn->prepare($query1);
$stmt->execute($data);
$count1 = $stmt->fetchall();
$count1 = count($count1);
if($count1 == 1){
    $query = "SELECT Password FROM creds WHERE username='$user'";
    $statement = $conn->prepare($query);
    $statement->bindParam(':user', $user);
    $statement->execute();
    foreach ($conn->query($query) as $row) {
        $result2 = $row['Password'] . "\t";
    }
    if(password_verify($plaintextpass,$result2)){
        //$seconds = 120 + time();
        echo("MATCH");
        //setcookie(loggedIn, date("F js - g:i a"), $seconds);
        //header("location:login_success.php");
    }else{
        echo "<br>Invalid info1";
        echo( "<br> <br> we received $result2 <br> you sent $plaintextpass");
    }
}
else{
        echo "Invalid info2";
}

I am so new to this that I am certain it's my fault and not the language. Also I am aware that I'm not advised to use password_hash. I'm doing it for simplicity at the moment and this is only a test environment for learning.

0 Answers
Related