I'm having an issue with the code below. It was pulled from here and slightly modified to include validation and fire when the appropriate forms were submitted and pass validation. The issue is with the hashing of the password.
The hashed password does not match the password in the database even though the password itself and the salt are identical. I've checked the $hashed_password variable against what is being written to the database. They match perfectly. On the login side, the salt matches, but when the same password is used, the part after the salt is different? The results look like this:
$2a$05$Bj79bEbmWG9GeMbBAIXID.zMtNecb3B5qWkiGZrSccWcefQG7IXUy $2a$05$Bj79bEbmWG9GeMbBAIXID.6qNLDcZ21XAKoSOIriqTxlAUjjTygoy
There was a problem with your user name or password.
Unless I'm missing something obvious, the only thing I could imagine is a different algorithm being used on register from login, but I'm not sure how to confirm that or correct. Any help is greatly appreciated.
<?php
$password = mysql_real_escape_string($_POST['password']);
$username = mysql_real_escape_string($_POST['username']);
//This string tells crypt to use blowfish for 5 rounds.
$Blowfish_Pre = '$2a$05$';
$Blowfish_End = '$';
// // PHP code you need to register a user
if($_SERVER['REQUEST_METHOD'] == "POST" && isset($_POST['register'])) {
global $valid;
user_reg_validate($con, $_POST['username'], $_POST['email'], $_POST['password'], $_POST ['password2']);
if ($valid != false) {
// Blowfish accepts these characters for salts.
$Allowed_Chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./';
$Chars_Len = 63;
// 18 would be secure as well.
$Salt_Length = 21;
$mysql_date = date( 'Y-m-d' );
$salt = "";
for($i=0; $i<$Salt_Length; $i++) {
$salt .= $Allowed_Chars[mt_rand(0,$Chars_Len)];
}
$bcrypt_salt = $Blowfish_Pre . $salt . $Blowfish_End;
$hashed_password = crypt($password, $bcrypt_salt);
$sql = "INSERT INTO login (username, salt, password) VALUES ('$username', '$salt', '$hashed_password')";
mysqli_query($con, $sql) or die( mysql_error() );
}
}
if($_SERVER['REQUEST_METHOD'] == "POST" && isset($_POST['login'])) {
global $valid;
user_login_validate($con, $_POST['username'], $_POST['password']);
if($valid != false) {
// Now to verify a user’s password
$sql = "SELECT salt, password FROM login WHERE username='$username'";
$result = mysqli_query($con, $sql) or die( mysql_error() );
$row = mysqli_fetch_assoc($result);
$hashed_pass = crypt($password, $Blowfish_Pre . $row['salt'] . $Blowfish_End);
echo $hashed_pass . "</br>";
echo $row['password'] . "</br>";
if ($hashed_pass == $row['password']) {
echo 'Password verified!';
} else {
echo 'There was a problem with your user name or password.';
}
}
}
?>