PHP中的password_verify无法使用数据库

Question

I am trying to make login form work using password_hash and password_verify function but I am not able to verify password due to some syntax error.

The following is my registration script

<?php
    include("includes/connection.php");
        if(isset($_POST['reg'])) {

        //registration form
        $u_email = mysqli_real_escape_string($con, $_POST['email']);
        $u_pass = mysqli_real_escape_string($con, $_POST['password']);


        $get_email = "SELECT * FROM user WHERE user_email='$u_email'";
        $run_email = mysqli_query($con, $get_email);
        $check = mysqli_num_rows($run_email);  



        if($check==0){   


        $hashed_pass = password_hash('u_pass', PASSWORD_BCRYPT, array('cost' => 10));  

        $insert = "insert into user (user_email, user_pass) values ('$u_email', '$hashed_pass')";

        $run_insert = mysqli_query($con, $insert);

        if($run_insert) {
            echo "<script>alert('Registration Successful!')</script>";
        }
        else {
            echo "<script>alert('Registration not Successful!')</script>";

        }
        }
        else{

        echo "Email already registered";
        }

        }


?>

The following is the login script

<?php

    include("includes/connection.php");

        if(isset($_POST['login'])) {

            $u_email = mysqli_real_escape_string($con,$_POST['u_email']);
            $u_pass = mysqli_real_escape_string($con,$_POST['u_pass']);

            $get_user = "select user_pass from user where user_email='$u_email'";
            if(password_verify($u_pass, $user_pass)){

                $_SESSION['user_email']=$u_email;
                echo "<script>alert('Login successfull')</script>";
            }
            else {
                echo "<script>alert('Password or email is not correct!')</script>";
            }

        }
?>

It is just showing ('Password or email is not correct!') even though login details are correct.

Answer 1

You are not passing the user password into password_hash() function. The first parameter should be the password i.e. $_POST['password'] not 'u_pass'.

$hashed_pass = password_hash($_POST['password'], PASSWORD_BCRYPT, array('cost' => 10));

Also be careful about SQL escaping. You should only escape strings that are going into a SQL string. In your code you cannot use $u_pass in password_hash() because you have used mysqli_real_escape_string so it's no longer the string the user entered.

Your login script also has a few bugs.

if(password_verify($u_pass, $user_pass)){

$u_pass has been through mysqli_real_escape_string so is not what the user entered. Also $user_pass will not be defined as you have not run the SQL and assigned user_pass to $user_pass.

I'd suggest taking a step back and leaving the password hashing out while you develop the code. Get it working with plain passwords stored in the database. Then you can verify it is saving the email/password correctly by looking in the database. Once it is working then add the password hashing code in.