使用password_verify登录CodeIgniter

Question

I'm trying to achieve to login implementation in CodeIgniter, I'm hashing password while registration like password_hash($this->input->post('password'),PASSWORD_DEFAULT) in my Controller and in the same Controller I'm trying to write a login method which is as followed :

public function loginValidation() {
        $this->form_validation->set_rules('email', 'Email', 'trim|required');
        $this->form_validation->set_rules('password', 'Password', 'trim|required');

        if ($this->form_validation->run()) {
            // true
            $email  =   $this->input->post('email');
            $password   =   $this->input->post('password');

            // User Model Loaded in constructor
            if ($this->user->canLogin($email, $password)) {
                $session_data   =   array('email' => $email );
                $this->session->set_userdata($session_data);
                redirect('profile/personal','Refresh');

            } else {
                $this->session->set_flashdata('error', 'Invalid Username or Password');
                //redirect('login','Refresh');

            }
        } else {
            // try again to login
            //redirect('login','Refresh');
        }
    }

My user Model function is

public function canLogin($email, $password) {
    $this->db->where('email',$email);
    $this->db->where('password',$password);
    $query  =   $this->db->get($this->tableName);

    if ($query->num_rows() > 0) {
        return true;
    } else {
        return false;
    }
}

I know I have to password_verify($string,$hash) at some point but I'm unable to figure out.

How do I validate the password against email and redirect to the desired view i.e. personal/profile and I'm making request via AJAX call.

Answer 1

What you need to do is fetch the record from the DB where only the email matches (assuming it is the Unique key). Then you compare the returned value using password_verify().
This is very rough and untested, but should give you an idea:

public function canLogin($email, $password) {
    $this->db->where('email',$email);
    // $this->db->where('password',$password);
    $query  =   $this->db->get($this->tableName);

    $row = $query->row();
    return $row ? password_verify($password, $row->password) : false;
}