Problem in Password verify

Question

Problem in Password verify

Navigation

#1 by (1 votes)

0

Friends I would like to know why in my condition IF for more than I always recognize it as false, I have verified and made the query correctly, the connection correctly and the array it brings is the following:

Array ( [IDUSUARIO] => 1 [USUARIO] => admin [CONTRASENIA] => admin )

What am I doing wrong other than being born? xdxd help please.

The data of the database, host, user and password are remote, I'm doing it on the HOSTINGER server.

<?php

$host_db = "xxxxx";
$user_db = "xxxxxx";
$pass_db = "xxxxx";
$db_name = "xxxxxx";

$conexion = new mysqli($host_db, $user_db, $pass_db, $db_name);

if ($conexion->connect_error) {
 print("La conexion falló: " . $conexion->connect_error);
}

$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM USUARIOS WHERE USUARIO = '$username'";

$result = $conexion->query($sql);


if ($result->num_rows > 0) {     

 $row = $result->fetch_array(MYSQLI_ASSOC);

 }
 if (password_verify($password, $row['CONTRASENIA'])){ 

    $_SESSION['loggedin'] = true;
    $_SESSION['username'] = $username;
    $_SESSION['start'] = time();
    $_SESSION['expire'] = $_SESSION['start'] + (5 * 60);

    print "Bienvenido! " . $_SESSION['username'];
    print "<br><br><a href=panel-control.php>Panel de Control</a>"; 

 }else{ 
   print "Username o Password estan incorrectos.";
  print_r($row);
     print "<br><a href='index.html'>Volver a Intentarlo</a>";
 }
 mysqli_close($conexion); 
 ?>

php

asked by Carlos Hernández 23.12.2016 в 07:54

source

1 answer

Load data in Textbox from Gridview Error opening the file. Fault PdfPTable iText - JAVA

score 1 · Accepted Answer

Clearly your mistake is:

In the database password is admin is not at any time done with password_hash and if we read the php documentation tells us:

boolean password_verify (string $ password, string $ hash)
Check that the hash provided matches the password facilitated.

Clearly what you are comparing is admin and admin, at no time do you generate a hash .

When you create a user, save your password with password_hash

$password = password_hash($password, PASSWORD_DEFAULT);

As in your database the password will remain as a hash you just do that:

if (password_verify($password_post, $row['CONTRASENIA'])) {