AngularJS PHP MYSQL用户登录

Question

I am working on a web application that requires the user to login in order to have access to the content. I am new to PHP, so I am trying to figure out if there is something wrong with my code when I try to retrieve the information from the database.

<?php 

include('./connection.php');
$loginInfo = json_decode(file_get_contents('php://input'));
$username = $loginInfo->username;
$password = password_hash($loginInfo->password, PASSWORD_DEFAULT);

$q = $db->prepare("SELECT * FROM userauth WHERE username=:username AND password=:password");
$q->bindParam(':username', $username, PDO::PARAM_STR);
$q->bindParam(':password', $password, PDO::PARAM_STR);
$q->execute();

$userRow=$q->fetch(PDO::FETCH_ASSOC);

if($userRow == true){
    print 'success';
}else{
    print 'error';
}

?>

Here is the Service for the Angular:

'use strict';

app.factory('loginSrv', function($http,$location){
return{
    login:function(loginInfo, scope){
        var $promise = $http.post('../app_back_end/app_endpoints/login.php', loginInfo);
        $promise.then(function(msg){
            if(msg.data == 'success'){
                console.log('success login');
                $location.path('/profile');
            }
            else {
                console.log('error login');
                scope.msgtxt = 'Want to try again? :)';
            }
        });
    }
}
});

Answer 1

password_hash() will not generate the same result twice from the same input.

So even if the entered password is the same as was entered originally when you re hash it, you wont get the same hash.

This is what password_verify() was invented for, so do your search using just the username and then use password_verify() to check passwords are the same.

<?php 

include('./connection.php');
$loginInfo = json_decode(file_get_contents('php://input'));
$username = $loginInfo->username;


$q = $db->prepare("SELECT * FROM userauth WHERE username=:username");
$q->bindParam(':username', $username, PDO::PARAM_STR);
$q->execute();

$userRow=$q->fetch(PDO::FETCH_ASSOC);

if(password_verify($loginInfo->password , $userRow['password'])){
    print 'success';
}else{
    print 'error';
}
?>