我的登录 PHP 表单不起作用。 我相信我的 $hash = $row['password']; 是问题，但我不太确定

Question

I'm currently in the process of creating my first website with PHP. I have created a MySQL database with a database and a table called "users" with the columns in order from left to right, "Personalid" (AUTOINCREMENT), "username" & "password" (hashed using password_hash($POST_['password']) .

Here is my HTML code for the form below

 <form  method="post" action="idk.php">
                    <h1>Sign In</h1>
                    <br>
                    <input type="text" placeholder="Username" name="username"/>
                    <input type="password" placeholder="Password" name="password"/>
                    <button type="submit" name="submit" value="Login">Sign In</button>
                </form>

Here's my php form, called idk.php

<?php
$conn=mysqli_connect('localhost','root','root',"user_hirsa");
if(!$conn){
   die('Could not Connect My Sql:' .mysql_error());
}
else {
    echo "Connected";
}
?>


<?php
$stmt = $conn->prepare("SELECT username, password FROM users WHERE username = ?");
$stmt->bind_param('s', $myusername);

$myusername = $_POST['username'];
$mypassword = $_POST['password'];
$hash = $row['password'];

$stmt->execute();
$stmt->bind_result($myusername, $mypassword);
$row = $stmt->fetch(); //fetch DB results


if (!empty($row)) { // checks if the user actually exists(true/false returned)
    if (password_verify($mypassword, $hash)) {
        echo 'success'; // password_verify success!
    } else {
    echo 'failed';
    }
} else {
    echo "This user does not exist"; //username entered does not match any in DB
}

$stmt->close();
$conn->close();
?>

I believe that my problem is with the $hash = $row['password'] , but I don't really know. My outcome is "connected" for the database connection, but always "failed", even if I enter a correct password. When I enter a wrong username it displays "This user does not exist", so no problem there.

Answer 1

You are almost correct. The hash should come from the database. A better naming convention for your variables maybe would help notice the mistake.

I made few changes to your script:

<?php

// enable error reporting
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
$conn = new mysqli('localhost', 'root', 'root', "user_hirsa");
// you should set the correct charset here
// $conn->set_charset('utf8mb4');

<?php

$myusername = $_POST['username'];
$mypassword = $_POST['password']; // plain password coming from login form

$stmt = $conn->prepare("SELECT password FROM users WHERE username = ?");
$stmt->bind_param('s', $myusername);
$stmt->execute();

// bind columns to variables
$stmt->bind_result($hashInDB);
$row = $stmt->fetch(); //fetch DB results

if ($row) { // checks if the user actually exists(true/false returned)
    if (password_verify($mypassword, $hashInDB)) {
        echo 'success'; // password_verify success!
    } else {
        echo 'failed';
    }
} else {
    echo "This user does not exist"; //username entered does not match any in DB
}

// you don't need these
// $stmt->close();
// $conn->close();

Generally it is a bad idea to let others know which user does/doesn't exist in the database. Just say that credentials are incorrect.

Answer 2

It appears you are trying to access $row before it is instantiated. As such, your $hash will be null. Try setting your hash after retrieving the results.

$row = $stmt->fetch();
$hash = $row['password'];