PHP password_verify() 似乎不起作用

Question

I have been going through the password_hash() and password_verify() methods in PHP and I've been trying to include that in my code. I can't seem to get it to work, I've gone through series of googling and even some of the questions here on SO but they don't seem to resolve the issue.

My column length in the database is 255. When I try to run the code, I get the $loginerror message. Here's my code block. Please what am I doing wrong.

$signin_email=$_POST['signin_email'];
$signin_password=$_POST['signin_password'];

if($valid){
    require_once 'scripts/connect_to_mysql.php';
    $sql = "SELECT First_name, Last_name,Password FROM customer WHERE Email=? AND Password=? LIMIT 1";
    $stmt=$conn->prepare($sql);//preparing the statement
    if(!$stmt){
        echo "Unable to prepare: ".$conn->errno. " " .$conn->error;
    }
    //executing the statement
    //$date=date('d m Y h:i:s');
    if(!$stmt->bind_param('ss', $signin_email, $signin_password)){//bind parameters to sql statement. i=integer, s=string, b=blob, d=double 
        echo "Binding parameters failed: ".$stmt->errno. " " . $stmt->error;
    }
    if(!$stmt->execute()){//executing the statement
        echo "Statement Execution failed: ". $stmt->error;
    }
    if(!$stmt->bind_result($dbfirstname,$dblastname,$dbpassword)){// used to bind variables to a prepared statement for result storage
        echo "Unable to bind results to variables: ".$stmt->error;
    }
    $stmt->store_result();
    //echo $stmt->num_rows;
    echo $dbpassword;
    if(password_verify($signin_password, $dbpassword)){
        if($stmt->num_rows===1){//to check if username and password actually exists
            while($row=$stmt->fetch()){
                $user=$dbfirstname. " ". $dblastname;
                echo $user;
            }

            /*$_SESSION['user']=$user;
            header('location:logintest.php');
            exit();*/
        }
    }
    else{
        //$error="Invalid Email address/Password. Please try again";
        $loginerror= "Invalid Email address/Password. Please try again";
    }

    $stmt->close();//closing the prepared statement
    $conn->close();//closing the connection
}

Answer 1

Problem does not lie in password_verify but in way that you build your query:

`$sql ="SELECT First_name, Last_name,Password FROM customer WHERE Email=? AND Password=? LIMIT 1";

You bind $signin_password to that query and it contains not hashed value from $_POST .

There are 2 solutions:

1) remove AND Password=? from your query - you will check your password with password_verify

2) change $signin_password to:

$signin_password=password_hash($_POST['signin_password']);

(but this way using password_verify is kind of irrelevant.

Answer 2

$signin_password=$_POST['signin_password'];

$hash = password_hash($dbpassword, PASSWORD_DEFAULT);

if (password_verify($signin_password, $hash)) 

 {

   echo 'Password is valid!';

 } 

 else 

 {

   echo 'Invalid password.';

 }

Try with this :) Better option is just build your own query.