User authentification / login issue (password hash)
 

I have no issues with inserting the data into the database, the signup form is working perfectly however, when trying to login the page keeps telling me that the user/pass is incorrect and I can't figure out why.

Im creating a session, pulling the fields from the database correctly and having looking in the SQL row, the passwords are being stored correctly.

Could someone point me in the right direction with the code below as to why this isnt working?

This isnt for anything fancy, just trying to have a system when employees can maintain their contact information and keep it up to date.

*Quick Edit*

I'm using this on the submission form for the password, if it matters.

You want to grab the clean user input (aka the password the user typed in), then compare that to the hash (in the database), I assume?

But here you are comparing the user input to $password (which is the hash/SQL entry, I guess?).

Shouldn't it be more like this this, in that case:

if (password_hash($_POST['password'], PASSWORD_BCRYPT) === $password)
{
....
}

Or... do you take the user input (password) from the form, then hash it using Bcrypt, before submitting the form?

It's a bit of a weird logic. Usually you take the raw input on submit, then after submit you'd hash it and compare those two hashes.

I think the problem now might be this: If the password is 'dildo', the Bcrypt hash is '$2a$10$F0eXLChOzrgQXlIL0hFdxOVQ9Y6it3dXIRGueIB54t cHqPvUUeUMO'

When you take that hash as input using $_POST, isn't php replacing the $2a, $10 parts etc with nothing, because these variables don't exists?

This ^^^^^

Yes, the user submits their required password and i encrypt it through submit.php when it gets written to the database.

Here is the submit.php file that sends data to SQL...

I beleive the part in bold should be doing the encrypting correctly and storing it in the 'password' column in the table that im calling from the login script?

That is not where your problem is.

zijlstravideo pointed it out.

In the code in your first post you have this line:

if ($_POST['password'] === $password)

You are comparing the unencrypted password that the user entered with the encrypted password from the database.

They will never match.

You need to encrypt the password entered to do the comparison.

So the code he put up there should replace the if you are using:

if (password_hash($_POST['password'], PASSWORD_BCRYPT) === $password)

.

I've changed that line and still get the same incorrect user/pass error :Oh crap

Thats why i thought there may have been an issue elsewhere in the submit.php i posted above.

Have you printed out what are in the 2 variables to see what you are comparing?

Also, you are printing out the same error msg in 2 places. Change 1 of them so you know exactly which error you are hitting.

.

Yeah, this should be easy to debug. If PHP tells you the two variables don't match, they don't match.

Echo both your $_POST variable and $password, and see why they don't match.

EDIT:
On your signup form, you use $password = mysqli_real_escape_string($link, $_REQUEST['password']), before you hash it and store it into your database.
Therefore, any added slashes before escaped characters become part of the hash as well.
Perhaps try: if(password_hash(mysqli_real_escape_string($_POST['password']), PASSWORD_BCRYPT) === $password)

His issue is very simple - he's using BCRYPT, which generates a different hash for the same string each time it's run. You can literally run it on the same password 100 times and get 100 different hashes. As such, you can't compare strings like you could with a normal salted MD5 or something.

You have to use this:
https://www.php.net/manual/en/functi...ord-verify.php

Haha, that explains a lot. The good old PHP docs to the rescue... :pimp

Good point, says inccorect username.

That doesnt seem to be working either :/

I'm still getting an error when using that K0nr4d.

Would it be best to change the encryption method at this point to something else or do you think I'll still run into the issue because of an existing coding issue? :Oh crap

Yeah just do salted MD5.

columns username, password, and salt
salt you insert a random string when inserting the user so each one has a unique salt.

$salt = md5(uniqid());
$password = md5($_POST['password'].$salt);

and then you just go

$result = mysqli_query($dblink, "SELECT * FROM users WHERE username = '".$_POST['username']."' AND password = MD5(CONCAT('".$_POST['password']."',salt))");

(naturally, youd' protect against sql injection but just writing like that to illustrate what goes where).

If there's a result, the user is valid. If it's empty, it's wrong login details.

Think you can still use it. leave your signup form as is (where you insert the hash into your db), then on your login form:

replace: if ($_POST['password'] === $password)

with:
if(password_verify(mysqli_real_escape_string($_POS T['password']), $password))


You've added slashes on your signup form, see this part of your code:
$password = mysqli_real_escape_string($link, $_REQUEST['password']);
// Securing password using password_hash
$secure_pass = password_hash($password, PASSWORD_BCRYPT);
So you need to add those again during login...

Edit: k0nr4d already replied and yeah, md5 + salt would be easier.

So I have it inserting a salt value into the SQL table, but where do I put that part above? Does that replace the original line of code I have bolded below or is that a completely new line of code?

Sorry this whole password hashing stuff has me confused af :Oh crap

Oh and one other question, for the salt column, do I set that at varchar(255) or does it need to be longer/shorter?

Its currently vachar(255).

You really need to check the PHP docs when you want to know something about a function.

https://www.php.net/manual/en/function.uniqid

"With an empty prefix, the returned string will be 13 characters long. If more_entropy is true, it will be 23 characters."


https://www.php.net/manual/en/function.md5.php

"Returns the hash as a 32-character hexadecimal number."