php - password_verify gives false after password_hash, should be true -
i keep getting wrong result , can't understand why.
i store new user , password this:
// password input $pass = $_post[ 'password' ]; $options = [ 'cost' => 12 ]; $pass = password_hash($pass, password_default, $options); // add db $sql = "insert clients(first_name, last_name, email, password_hash) values ('$fname', '$lname', '$email', '$pass')";
for password '123456' this: $2y$12$dud9lwgk2b26r2nqz6ksfexfrhi/36rjrq8lao8vk6xc6vkibipvg
next step verify password:
// password input $pass = $_post[ 'password' ]; // row hash database $sql = "select email, password_hash, active clients email = '$email'"; $result = mysqli_query($conn, $sql); if (mysqli_num_rows( $result ) == 0) { // email not found in database... } $row = mysqli_fetch_assoc($result); // true if password correct if ( password_verify( $pass, $row['password_hash'] ) ) { // logged in } else { $passindb = $row['password_hash']; // login failed $_session['error'] = "incorrect email or password. cannot verify: $pass ,\n $passindb" ; // redirect login page header('location: ../index.php'); }
now when try log in get:
incorrect email or password. cannot verify: 123456 , $2y$12$dud9lwgk2b26r2nqz6ksfexfrhi/36rjrq8lao8vk6xc6vkibipvg
i don't understand why password_verify gives me false...
Comments
Post a Comment