I know that theres been multiple questions asked in regards to PHP password_verify, however I did not see any answers that applied or worked in my situation.
I am storing a password in my database with the following code
$pwhash = password_hash("test123",PASSWORD_DEFAULT);
$sql = "INSERT INTO creds (Username, Password, IsAdmin) VALUES('mtpotts','$pwhash' , 1)";
$conn->exec($sql);
Which will store for example "$2y$10$CfV8ZZZLWtfADpmgOg4d5OUw56sEHo2EF5pQr33jTEZdPj9LZXUkG"
Running that through a character counter I get 60 letters. If I check the data base I have "$2y$10$CfV8ZZZLWtfADpmgOg4d5OUw56sEHo2EF5pQr33jTEZdPj9LZXUkG" So I can see that the database isn't setup too small to hold the 60 characters.
On my login page I have the following code
$user = htmlspecialchars($_POST["fname"] ?? "", ENT_QUOTES);
$plaintextpass = htmlspecialchars($_POST['pword'] ?? "", ENT_QUOTES);
try {
$conn = new PDO("mysql:host=$servername;dbname=Username", $username,$password);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
echo "<br>Connected<br>";
} catch (PDOException $e) {
echo "Connection failed" . $e->getMessage();
}
$query1 = "SELECT * FROM creds WHERE username='$user'";
$stmt= $conn->prepare($query1);
$stmt->execute($data);
$count1 = $stmt->fetchall();
$count1 = count($count1);
if($count1 == 1){
$query = "SELECT Password FROM creds WHERE username='$user'";
$statement = $conn->prepare($query);
$statement->bindParam(':user', $user);
$statement->execute();
foreach ($conn->query($query) as $row) {
$result2 = $row['Password'] . "\t";
}
if(password_verify($plaintextpass,$result2)){
//$seconds = 120 + time();
echo("MATCH");
//setcookie(loggedIn, date("F js - g:i a"), $seconds);
//header("location:login_success.php");
}else{
echo "<br>Invalid info1";
echo( "<br> <br> we received $result2 <br> you sent $plaintextpass");
}
}
else{
echo "Invalid info2";
}
I am so new to this that I am certain it's my fault and not the language. Also I am aware that I'm not advised to use password_hash. I'm doing it for simplicity at the moment and this is only a test environment for learning.