password_verify从数据库返回false以获取正确的密码

Question

I'm creating a login form for a site. The validation worked fine prior to me trying to incorporate security with PHPs built in password_hash() and password_verify() fucntions. I'm using the bcrypt algorithm for encryption with said functions.

The issue is that when the correct username and password are entered into the login form password_verify returns false and as such the validation is unsuccessful, preventing login. I've done a great deal of searching around but have not found any solutions that sort this. The below code (admin_login.php) manages both the login form and processes the login as well.

I'm including my code and also a screenshot of the structure of my MySQL 'login' table within the phpmyadmin control panel.

Thanks in advance.

Table Structure:

(Being new I don't have the rep to post images so here's a gyazo link: http://gyazo.com/a423e5ba38fe5200a8198b47a66fe75a )

admin_login.php

    <?php   
    error_reporting(E_ALL & ~E_NOTICE);
    session_start();

    if (isset($_SESSION['id']) && $_SESSION['admin'] == 1) {
        $userID = $_SESSION['id'];
        $username = $_SESSION['username'];
        header('Location:admin_panel.php');
    }

    if (isset($_POST['submit'])) {
        include_once("connection.php");
        $username = strip_tags($_POST['username']);
        $password = strip_tags($_POST['password']);

        $sql = "SELECT id, username, password, admin FROM login WHERE username = '$username' AND activated = '1' AND admin = '1' LIMIT 1";
        $query = mysqli_query($dbCon, $sql);

        if ($query) {
            $row = mysqli_fetch_row($query);
            $userID = $row[0];
            $dbUsername = $row[1];
            $dbPassword = $row[2];
            $admin = $row[3];
        }

        // VALIDATES LOGIN CREDENTIALS //

/*      $verify = password_verify('123', $trimmed);
        var_dump($password);
        var_dump($dbPassword);
        var_dump($verify); */

        // checks if user is valid in database and admin
        if ($username == $dbUsername AND $verify && $admin = 1) {
            $_SESSION['username'] = $username;
            $_SESSION['id'] = $userID;
            $_SESSION['admin'] = $admin;
            header('Location:admin_panel.php');
            die();
        } elseif ($admin == 0) {
            echo "Either you are not an admin user or you have entered an incorrect username/password combination. <br><br> <a href='index.php'>Click Me</a> to return to the homepage.";
            //TODO: ADD LINK TO USER LOGIN PAGE
            die();
        } else {
            echo "Incorrect username/password combo";
            exit();
        }
    }


?>
<?php

    $pageTitle = "Casa Mirador | Admin";
    include_once('inc/header.php');
?>
    <h2 style="text-align: center;">Admin Login</h2>

    <div class="login_section_one">
        <div class="wrapper">

            <!-------- ADMIN LOGIN FORM ---------->

            <form method="POST" action="admin_login.php" id="admin_form">
                <table class="form_login">
                    <tr>
                        <th>
                            <label for = "username"> Username </label>
                        </th>
                        <td>
                            <input type="text" name="username" id="username">
                        </td>
                    </tr>
                    <tr>
                        <th>
                            <label for = "password"> Password </label>
                        </th>
                        <td>
                            <input type="password" name="password" id="password">
                        </td>
                    </tr>
                </table>    
                <input type="submit" id="submit" name="submit" value="Login">
            </form>


        </div>


<?php
    include_once('inc/footer.php');
?>

Answer 1

In this code snipped there is no $verify variable defined, it is commented out, so this conditional statement goes to 'else' section. Also $dbUsername always equals to $username , because that's in your WHERE clause in your $sql - so you don't need to check that again.

Another thing: you omitted one = character - change

if ($username == $dbUsername AND $verify && $admin = 1) {

to

if ($username == $dbUsername AND $verify && $admin == 1) {

you assigned 1 to $admin instead of checking if $admin == 1

Answer 2

This should work.

if (isset($_POST['submit'])) {
    include_once("connection.php");
    $username = strip_tags($_POST['username']);
    $password = strip_tags($_POST['password']);

    $sql = "SELECT id, username, password, admin FROM login WHERE username = '$username' AND activated = '1' AND admin = '1' LIMIT 1";
    $query = mysqli_query($dbCon, $sql);

    if ($query) {
        $row = mysqli_fetch_row($query);
        $userID = $row[0];
        $dbUsername = $row[1];
        $dbPassword = $row[2];
        $admin = $row[3];
    }

    $verify = password_verify($_POST['password'], $dbPassword); // This should work

    if ( $verify ) { // You don't need to check username and is admin, because this is done in the query to the database.
        $_SESSION['username'] = $username;
        $_SESSION['id'] = $userID;
        $_SESSION['admin'] = $admin;
        header('Location:admin_panel.php');
        die();
    } elseif ($admin == 0) {
        echo "Either you are not an admin user or you have entered an incorrect username/password combination. <br><br> <a href='index.php'>Click Me</a> to return to the homepage.";
        //TODO: ADD LINK TO USER LOGIN PAGE
        die();
    } else {
        echo "Incorrect username/password combo";
        exit();
    }
}

Answer 3

Why isn't mine working? It goes to "incorrect password combination" even though the password is correct.

function vertifyPass($userEmail, $userPass)
  {
    $sqlStatement = "SELECT user_pass FROM user WHERE user_email = :userEmail";
    $preparedStatement = $this->db->prepare($sqlStatement);
    $preparedStatement->bindParam(':userEmail', $userEmail);
    if($preparedStatement->execute())
    {
      $userData = $preparedStatement->fetch();
      $vertify = password_verify($userPass, $userData['user_pass']);
      if($vertify)
      {
        session_start();
        $_SESSION['user_email'] = $userEmail;
        header('Location: /profile.php');
      }
      else
      {
        echo "The username and password combinations was incorrect.";

      }
    }