登录时 password_verify() 总是返回 false

Question

I'm currently writing a database system for my website, and I'm having a huge issue that I can't seem to figure out.

As seen here, my registration code hashes the password in bcrypt before sending it to the database.

if (isset($_POST['reg_user'])) {
  // receive all input values from the form
  $username = mysqli_real_escape_string($db, $_POST['username']);
  $email = mysqli_real_escape_string($db, $_POST['email']);
  $password_1 = mysqli_real_escape_string($db, $_POST['password_1']);
  $password_2 = mysqli_real_escape_string($db, $_POST['password_2']);

  // check that all the form inputs are valid
  // if not, push an error to the array
  if (empty($username)) { array_push($errors, "Username is required."); }
  if (empty($email)) { array_push($errors, "Email is required."); }
  if (empty($password_1)) { array_push($errors, "Password is required."); }
  if ($password_1 != $password_2) {
    array_push($errors, "Passwords do not matchh.");
  }

  // check the db for existing usernames or emails
  $user_check_query = "SELECT * FROM users WHERE username='$username' OR email='$email' LIMIT 1";
  $result = mysqli_query($db, $user_check_query);
  $user = mysqli_fetch_assoc($result);
  
  if ($user) { // if inputted username exists in db, send error
    if ($user['username'] === $username) {
      array_push($errors, "Username already in use.");
    }

    if ($user['email'] === $email) {
      array_push($errors, "E-Mail already in use.");
    }
  }

  // Register if there are no errors
  if (count($errors) == 0) {
    $password = password_hash($_POST['password_1'], PASSWORD_BCRYPT); // Hash the password to secure it before inserting it to the db
    var_dump($_POST['password_1'], $password);
    $query = "INSERT INTO users (username, email, password) 
              VALUES('$username', '$email', '$password')";
    mysqli_query($db, $query);
    $_SESSION['username'] = $username;
    header('location: home.php');
  }
}

Everything works fine here, it hashes the password perfectly fine.

But the problem occurs in the login system. I use the function "password_verify()", but it always returns false and gives the error. I'm entering the same password I used during registration, but it still says it is wrong.

// login
if (isset($_POST['login_user'])) {
  $username = mysqli_real_escape_string($db, $_POST['username']);
  $password = mysqli_real_escape_string($db, $_POST['password']);

  if (empty($username)) {
    array_push($errors, "Username is required.");
  }
  if (empty($password)) {
    array_push($errors, "Password is required.");
  }

  if (count($errors) == 0) {
    $query = "SELECT * FROM users WHERE username='$username'";
    $results = mysqli_query($db, $query);
    if (mysqli_num_rows($results) == 1) {
       while($row = mysqli_fetch_array($results))  
                {  
                     var_dump($_POST['password'], $row['password']);
                     if(!password_verify($_POST['password'], $row["password"]))  
                     {  
                          // incorrect password.
                          array_push($errors, "Username or password is incorrect.");
                     }  
                     else  
                     {  
                          // login the user
                          $_SESSION['username'] = $username;
                          header('location: home.php');
                     }  
                }  
    }else {
      array_push($errors, "Username or password is incorrect.");
    }
  }
}

I'm genuinely confused as to what went wrong. Please keep in mind that this is the first time I've done anything other that MD5 encryption, which I heard is very vulnerable.

All answers are appreciated. Thanks!

Answer 1

Nevermind, I somehow figured it out and it's working perfectly now.