php - password_verify gives false after password_hash, should be true -


i keep getting wrong result , can't understand why.

i store new user , password this:

// password input $pass = $_post[ 'password' ];  $options = [     'cost' => 12 ];  $pass = password_hash($pass, password_default, $options); // add db  $sql = "insert clients(first_name, last_name, email, password_hash) values ('$fname', '$lname', '$email', '$pass')"; 

for password '123456' this: $2y$12$dud9lwgk2b26r2nqz6ksfexfrhi/36rjrq8lao8vk6xc6vkibipvg

next step verify password:

// password input $pass = $_post[ 'password' ];  // row hash database  $sql = "select email, password_hash, active clients email = '$email'"; $result = mysqli_query($conn, $sql); if (mysqli_num_rows( $result ) == 0) {     // email not found in database...  }  $row = mysqli_fetch_assoc($result);  // true if password correct if ( password_verify( $pass, $row['password_hash'] ) )  {     // logged in } else  {     $passindb = $row['password_hash'];     // login failed     $_session['error'] = "incorrect email or password. cannot verify: $pass ,\n $passindb" ;     // redirect login page     header('location: ../index.php');    } 

now when try log in get:

incorrect email or password. cannot verify: 123456 , $2y$12$dud9lwgk2b26r2nqz6ksfexfrhi/36rjrq8lao8vk6xc6vkibipvg

i don't understand why password_verify gives me false...


Comments

Popular posts from this blog

python - mat is not a numerical tuple : openCV error -

c# - MSAA finds controls UI Automation doesn't -

wordpress - .htaccess: RewriteRule: bad flag delimiters -