password_verify即使使用适当的变量，也始终返回False

Question

My webpage starts with a login page, like many, and if the user has no account they can sign up. My sign up works and the users password they input is successfully hashed with password_hash and sent to the database. However, when trying to login, password_verify always returns false. Thinking I made a silly error when I originally made the hashed password, I echoed the variable I was using as the second parameter in password_verify . However, it was an exact match to the hash in the database. What could be the issue?? Shortened code is available below for both creating the password during sign up and checking the password while logging in.

CREATING HASHED PASSWORD

<?php
    session_start();
    require('db_credentials.php');

    $inputUsername = $_POST['createUsername'] ? $_POST['createUsername'] : null;
    $inputPassword = $_POST['createPassword'] ? $_POST['createPassword'] : null;
    $vPassword = $_POST['verifyPassword'] ? $_POST['verifyPassword'] : null;

     //protect database from corrupt user input
    $inputUsername = $mysqli->real_escape_string($inputUsername);
    $inputPassword = $mysqli->real_escape_string($inputPassword);
    $vPassword = $mysqli->real_escape_string($vPassword);

    //create connection
    $mysqli = new mysqli($servername, $username, $password, $dbname);

    $protectedPassword = password_hash($inputPassword, PASSWORD_DEFAULT);

    //Check if the passwords match
if($inputPassword != $vPassword){
    echo '<p style = "text-align: center;">Oops!The passwords you input did not match. Please try again.</p>';
    session_write_close();
    exit;
}

//Check for duplicate username
$query = "SELECT * FROM user_info WHERE username = ' ".$inputUsername." ' ";
$result = mysqli_query($mysqli, $query);

if(mysqli_num_rows($result) == 1) {
    echo '<p style = "text-align: center;">Oops! That Username is already taken. <br>Please try a different one.</p>';    
    session_write_close();
    exit;
}
//Username is not takin and the passwords match
else {
    $sql = "INSERT INTO user_info (username, password) VALUES (' ".$inputUsername." ', ' ".$protectedPassword." ')";
    echo '<p style = "text-align: center;">Success! You Have Made an Account!</p>';
    if($mysqli->query($sql) === TRUE) {
        session_write_close();
        exit;
    }
     else {
         echo "Error: " . $sql . "<br>" . $conn->error;
    }
}
?>

LOGGING IN

<?php

    require('db_credentials.php');

    $inputUsername = $_POST['username'] ? $_POST['username'] : null;
    $inputPassword = $_POST['password'] ? $_POST['password'] : null;
    //protect database from corrupt user input
    $inputUsername = $mysqli->real_escape_string($inputUsername);
    $inputPassword = $mysqli->real_escape_string($inputPassword);

    $mysqli = new mysqli($servername, $username, $password, $dbname);        

    $query = "SELECT * FROM user_info WHERE username = ' ".$inputUsername." ' ";
    $result = $mysqli->query($query);

    //check if username is in database. If it is, do the passwords match?
    if($result->num_rows === 1) {

        $row = $result->fetch_array(MYSQLI_ASSOC);
        echo $row['password'] . "<br>"; //matches hash in database exactly
        echo $inputPassword; //matches the password I type in. Which is same I used to sign up.
        if(password_verify($inputPassword, $row['password'])){
            header("Location: puzzlerMember.php"); //this never happens
            exit; 
        }

    }    
    echo '<p style = "text-align: center;">Oops! Your Username/Password is incorrect. Sign up if you do not have an account.</p>'; //this always happens
    exit;

?>

Note: In the database, I have the password column set to VARCHAR(255). I've looked at many of these questions which are similar, but they all seemed to have mistaken the length of their password in the database to be too short. If they did not, I tried the top answer of the solutions. I have absolutely no idea what is wrong. If you can help, I thank you in advance.

Answer 1

You are escaping your password, as a result this changes the password from what it was. Instead of relying on escaping as a security measure (which in itself is a misconception), use prepared statements.

As per the comment below, a clarification is required it seems: You are escaping the password then hashing it, as a result what is stored in the db is not what the user passes therefore it will never find what the user passes, hence, false is always returned.

Related: Should I mysql_real_escape_string the password entered in the registration form?

Update #1

As spotted by @mario, you seem to have spaces in your query when you are passing the values to it as such, it is searching your table for incorrect values.

Reading Material

Prepared Statements