Login function only works once

Question

I have the following php functions that process a user logging in. The functions are part of a class User.

/*
 * detail() function to get a detail from a database
 * exists() function to check if something exists in a database
 */

private function generate($password, $username = null) {
    if(is_null($username)) {
        $date = '0000-00-00';
    } else {
        $date = $this->_db->detail('last_active', 'users', 'username', $username);
    }

    // This is not the real thing but it will do as an example
    $salt = md5(strrev($password.$date));
    $password = md5($salt.$password.$date).strrev($password);

    return $password;
}

public function login($data = array()) {
    // Check if the user exists
    $username = $data['username'];
    if($this->_db->exists('username', 'users', 'username', $username)) {
        $password = $this->generate($data['password'], $username);

        // If the account is active
        if ($this->_db->detail('active', 'users', 'username', $username) === 1) {
            $stmt = $this->_db->mysqli->prepare("SELECT `username`, `password` FROM `users` WHERE `username` = ? AND `password` = ? AND `active` = 1");
            $stmt->bind_param('ss', $username, $password);
            $stmt->execute();
            $stmt->store_result();

            if($stmt->num_rows >= 1) {
                // Function to update last_active
                if($this->updateLastActive($username)) {
                    // Function to update password
                    if($this->updatePassword($username, $this->generate($password, $username))) {
                        // Set the session
                        $this->_session->set('user', $this->_db->detail('id', 'users', 'username', $username));

                        if($this->_session->exists('user')) {
                            return true;
                        } else {
                            echo 'Logging in went wrong';
                            return false;
                        }
                    } else {
                        echo 'Editing the password went wrong';
                        return false;
                    }
                } else {
                    echo 'Editing last active date went wrong';
                    return false;
                }
            } else {
                echo 'Wrong username and password combination';
                return false;
            }
        } else {
            echo 'Account not active';
            return false;
        }
    } else {
        echo 'Username doesn\'t exists';
        return false;
    }
}

private function updateLastActive($username) {
    $date = date('Y-m-d');

    $stmt = $this->_db->mysqli->prepare("UPDATE `users` SET `last_active` = ? WHERE `username` = ?");
    $stmt->bind_param('ss', $date, $username);
    $stmt->execute();

    if($stmt->affected_rows >= 1) {
        return true;
    } else {
        return false;
    }
}

private function updatePassword($username, $password) {
    $stmt = $this->_db->mysqli->prepare("UPDATE `users` SET `password` = ? WHERE `username` = ?");
    $stmt->bind_param('ss', $password, $username);
    $stmt->execute();

    if($stmt->affected_rows >= 1) {
        return true;
    } else {
        return false;
    }
}

The user can login with no problem when he just registered. But when the user is logged out and than tries to login again it will fail. The part I get an error on is the following:

$stmt = $this->_db->mysqli->prepare("SELECT `username`, `password` FROM `users` WHERE `username` = ? AND `password` = ? AND `active` = 1");

I tried to find out where the script fails with echo on different places in the functions but I couldn't find the error. The reason why the generate() function has $username = null is because the same function is used for registration.

So all functions are working but they only work once so this leaves me that someting in the generate() function is wrong. I always get the message that there is something wrong with the username / password combination

If someone could point me in the right direction I would be very happy.

Thanks in advance

UPDATE The detail() and exists() functions are part of a class Database.

public function detail($detail, $table, $column, $value) {
        if(is_array($detail)) {
            $data = array();

            foreach($detail as $key) {
                $stmt = $this->mysqli->prepare("SELECT `$key` FROM `$table` WHERE `$column` = ?");
                if(is_numeric($value)) {
                    $stmt->bind_param('i', $value);
                } else {
                    $stmt->bind_param('s', $value);
                }
                $stmt->execute();
                $stmt->bind_result($detail);
                $stmt->fetch();
                $data[] = $detail;
                $stmt = null;
            }

            return $data;
        } else {
            $stmt = $this->mysqli->prepare("SELECT `$detail` FROM `$table` WHERE `$column` = ?");

            if(is_numeric($value)) {
               $stmt->bind_param('i', $value);
            } else {
                $stmt->bind_param('s', $value);
            }
            $stmt->execute();
            $stmt->bind_result($detail);
            $stmt->fetch();

            return $detail;
        }
    }

    public function exists($detail, $table, $column, $value) {
        $stmt = $this->mysqli->prepare("SELECT `$detail` FROM `$table` WHERE `$column` = ?");
        switch(is_numeric($value)) {
            case true:
                $stmt->bind_param('i', $value);
                break;
            case false:
                $stmt->bind_param('s', $value);
                break;
        }
        $stmt->execute();
        $stmt->store_result();

        if($stmt->num_rows >= 1) {
            return true;
        } else {
            return false;
        }
    }

Answer 1

Create a hash field in your table, make it long enough to avoid length issue.

md5() is not acceptable now, you should be using better hash function such as password_hash()

Register:

private function register($username, $password) {
    //safer than md5() anyway
    $hash = password_hash($password, PASSWORD_DEFAULT);
    $sql = 'INSERT INTO table_name (`username`, `hash`) VALUES (?, ?);'
    $stmt = $this->_db->mysqli->prepare($sql);
    $stmt->bind_param('ss', $username, $hash);
    $stmt->execute();

    if($stmt->affected_rows >= 1) {
        return true;
    } else {
        return false;
    }
}

Login :

public function login($username, $password) {
    // Check if the user exists
    if($this->_db->exists('username', 'users', 'username', $username)) {
        // If the account is active
        if ($this->_db->detail('active', 'users', 'username', $username) === 1) {
            $sql = 'SELECT `username`, `hash` FROM `users` WHERE `username` = ? AND `active` = 1';
            $stmt = $this->_db->mysqli->prepare();
            $stmt->bind_param('ss', $username, $hash);
            $stmt->execute();
            $stmt->store_result();

            if($stmt->num_rows === 1) {
                if (password_verify($password, $hash)) {
                    // Function to update last_active
                    if($this->updateLastActive($username)) {
                        echo 'last active updated, Login successful';
                        return true;
                    } else {
                        echo 'Editing last active date went wrong';
                        return false;
                    }
                } else {
                    echo 'Wrong username and password combination';
                    return false;
                }
            } else {
                echo 'Account not active';
                return false;
            }
        } else {
            echo 'Username doesn\'t exists';
            return false;
        }
    }
}

Of course you can still use custom salt, for example

$hash = password_hash($password
                     ,PASSWORD_DEFAULT
                     ,array('salt' =>generate()));//generate() returns the salt