PHP登录页面不适用于password_verify

Question

So, I have hashed the password for new accounts which are created on adduser.php with this:

if (isset($_POST['submit'])) {

    require "../functions/db-insert.php";
    $productcategory = [
        'username' => $_POST['username'],
        'password' => sha1($_POST['password']),
        'isadmin' => $_POST['isadmin']
    ];

    //$hash = password_hash($_POST['password'], PASSWORD_DEFAULT); 
    $category = insert($pdo, 'users', $productcategory);

    echo "<p>User added</p>";
}

and now I'm trying to modify my login.php to be able to sign properly using password_verify, but I seem to be doing something wrong as I can no longer sign in.

if (isset($_POST['submit'])) {

if (isset($_POST["username"]) && isset($_POST["password"]))  {


    $results = $pdo->prepare("SELECT * FROM users 
               WHERE username = :username AND password = :password");

    $values = [
        ':username' => $_POST["username"],
        ':password' => $_POST['password']
    ];

    $password = $_POST['password'];
    $hash = password_hash($password, PASSWORD_DEFAULT);

    $results->execute($values);

    $row = $results->fetchAll();

    if(count($row) < 1){
        echo '<h3><strong>Wrong username or password!</h3>';
    }
    else if (!password_verify($password, $hash)){
        $_SESSION['loggedin'] = true;
        $_SESSION['name'] = $_POST['username'];
        echo "<h3>Welcome back " . $_SESSION['name'] . " !</h3>"; 
    }
  }
}

At this point, I'm not entirely sure what I'm doing wrong and would really appreciate if someone could help me troubleshoot the stuff I do wrong. I've looked all over stackoverflow but none of the previously asked questions were working for me, unfortunately.

Answer 1

You're re-hashing the password. When you use password_hash you don't get the same value for the same string, so you are never going to find a match. You need to select the password (hashed) and then pass the raw string (input) into password_verify . So just have the username in the where, then use result password and the raw string in password_verify

Try echoing out a password_hash of the same value (eg password_hash('test'....) . and you will see. You also need to account for using md5 is this is what you have done before. If this is a live system it will be difficult as you will basically need to make everyone change their password or write some routine to update it next time they log in (eg use the old verification method then password_hash() the password and update it). If this isn't production code yet just clear your your passwords and start again.

Also I just noticed you have said you want to log people in if the password verification returns false , (!password_verify... . So your logic back to front