php password_verify() hash and pass won’t match

by

“When I echo $valid the output is $2y$10$zzZCN7UlukvY2skb3ELVp.4y3Oc7NJTEsFyqdstqYxT”

$2y$10$zzZCN7UlukvY2skb3ELVp.4y3Oc7NJTEsFyqdstqYxT the hash is only 50 in length and is invalid/too short and as I said, MySQL will fail silently; error reporting/checking would not have helped here.

The password’s column length should be 60 (255 is suggested), so it wasn’t stored correctly originally.

You will need to clear your password column/or table, increase your column’s length, and start over again.

Reference:

“Therefore, it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice).”

You can also modify your query to read as:

$con = new mysqli("xxx", "xxx", "xxx", "xxx");
if ($con->connect_error) {
    die('Connect Error (' . $con->connect_errno . ') '
            . $con->connect_error);
}

$query = "SELECT `pass` FROM `user` WHERE `email`='$emailLogin'";
$result = $con->query($query);

// error checking on the query
if (!$result) {
    echo "<p>There was an error in query: $query</p>";
    echo $con->error;
}

$row_hash = $result->fetch_array();
if (password_verify($passLogin, $row_hash['pass'])) {
    echo "Success!";
}

Edit:

Adding from a comment I left to the OP:

Your verify function needs to have a connection made to your database, that is what I feel is happening here (variable scope). So you’ll need to either use global $con; or pass the connection (variable) to your function (which is better in most cases).

I don’t know if you’re doing an “include” for the function, and if so, then that’s what the other problem is.

I.e.: function VUP($con, $check, $valid){ or function VUP($check, $valid){ global $con; – Try both. Use $result = mysqli_query($con, $query) or die(mysqli_error($con)); instead of the one you have now.

More Related Contents:

  1. Save the data into a database and return another value from database using PHP
  2. inserting information and image in php and mysql
  3. Can I mix MySQL APIs in PHP?
  4. mysqli or die, does it have to die?
  5. How to check if a row exists in MySQL? (i.e. check if username or email exists in MySQL)
  6. How to change mysql to mysqli?
  7. MySQL vs MySQLi when using PHP [closed]
  8. How to get count of rows in MySQL table using PHP?
  9. MySQLi prepared statements error reporting [duplicate]
  10. Correct way to use LIKE ‘%{$var}%’ with prepared statements?
  11. Why is mysqli giving a “Commands out of sync” error?
  12. MySQLi count(*) always returns 1
  13. Warning: mysqli_connect(): (HY000/2002): No such file or directory
  14. How can I enable the MySQLi extension in PHP 7?
  15. mysqli_stmt::bind_param(): Number of elements in type definition string doesn’t match number of bind variables
  16. Advantages Of MySQLi over MySQL [closed]
  17. check if the query results empty row mysqli [duplicate]
  18. PHP PDO and MySQLi [duplicate]
  19. Is mysql_real_escape_string() necessary when using prepared statements?
  20. Updating from MYSQL to MYSQLI [duplicate]
  21. PHP + MySql + Stored Procedures, how do I get access an “out” value?
  22. How to prepare statement for update query? [duplicate]
  23. Get number of rows matched by UPDATE query with PHP mysqli
  24. How to use mysqli_query() in PHP?
  25. PHP to MySQL SSL Connections
  26. PHP: mysql v mysqli v pdo [closed]
  27. How do I ensure I caught all errors from MySQLi::multi_query?
  28. Cannot figure out how to run a mysqli_multi_query and use the results from the last query
  29. How to get a list of databases?
  30. Why cannot the PHP hide the error message thrown by the MySQL connection?

Leave a Comment