即使具有哈希值和用户密码，password_verify也不起作用

Question

I'm writing log in code for the only user in my db . But the password_verify function doesn't seem to work. When I echo both the hash from the db and the password written in the form, I see them, so there's no problem with the query or the $_POST .

Here's my code: the log in:

$passwordFromForm = htmlspecialchars($_POST['password']);
$nmbr = 12; // it's the user's id.
$sql = "SELECT * FROM user WHERE iduser = $nmbr";
$res = mysqli_query($conn, $sql);
// $row = mysqli_fetch_assoc($res);
while($row = $res->fetch_assoc()) {
    $hashFromDB = $row['hash'];
}
if(password_verify($passwordFromForm, $hashFromDB)) {
    echo "success";
    header("Location: ../admin.php");
}
else {
    echo "The hash is:" . $hashFromDB . "and the pass is:" . $passwordFromForm;
    //this echoes the correct hash and string
}

Thanks in advance.

Answer 1

该函数password_verify（）与password_hash（）相关，您可以检查所使用的算法password_hash（）与password_verify（）是否相同，并使用password_get_info（$ hash）检查res

Answer 2

You should not do any escaping of the password, before feeding it to the password_hash() / password_verify() function. So remove the call to htmlspecialchars() and make sure that your database field holding the hash, is of type varchar(255) .