PHP：password_verify总是返回false

Question

somehow I'm struggling with something that I expected to be straightforward. I created the following code just for testing purposes and I expected it to give the answer "valid password" in case the provided $login_password is "123456". But I always get "Invalid password."

$login_password = $_POST['login_password'];
$login_password_hash = password_hash($login_password, PASSWORD_DEFAULT);

$target_password = '123456';
$target_password_hash = password_hash($target_password, PASSWORD_DEFAULT);

if ( password_verify($login_password_hash, $target_password_hash) ) {
    echo "Valid password.";
    } 
else {
    echo "Invalid password.";
    }

I even get "Invalid password." when changing the password_verify to compare the same variable with itself:

password_verify($login_password_hash, $login_password_hash)

A little help is highly appreciated :)

Answer 1

You need to pass simple text password without hash as first param

if ( password_verify($login_password , $target_password_hash) ) {
    echo "Valid password.";
    } 
else {
    echo "Invalid password.";
    }