使用password_verify登录用户

Question

I'm creating a back end to my website and running into issues with the login user part.

The user registration into the database is made with the password_hash function using the code below:

UserReg.php :

<?php

require_once 'db.php';
$mysqli = new mysqli($host, $user, $password, $dbname);

if($mysqli -> connect_error) {
die($mysqli -> connect_erro);
}

$username = "userF";
$password = "somePass";
$token = password_hash("$password", PASSWORD_DEFAULT);

add_user($mysqli,$username, $token);

function add_user($mysqli,$username, $token) {
    $query = $mysqli->prepare("INSERT INTO users(username, password) VALUES 
    (?,?)");

$query->bind_param('ss',$username, $token);
$query->execute();
$result = $query->get_result();

if(!$result) {
    die($mysqli->error);
}
$query->close();
}

My login form skips to a blank page even when i insert my username and password. Doesn't even go to the login error message.

Login.php

<?php

include 'db.php';

$username = $_POST['user'];
$pwd = $_POST['password'];

$sql = "SELECT password FROM users WHERE username = ?";

$stmt = $mysqli->prepare($sql); 
$stmt->execute();
$stmt->bind_result($pass);

while ($result = $stmt->num_rows()) {
    if($stmt->password_verify($pwd, $result)) {    
        echo "Your username or password is incorrect";
    } else {
        header("Location: Menu.php");  
    }
}

What am i missing?

Appreciate your help.

Answer 1

I think you need to take a look at password_verify how it works.

$username = $_POST['user'];
$pwd = $_POST['password'];

$sql = "SELECT username, password FROM users WHERE username = ?";

$stmt = $mysqli->prepare($sql);
$stmt->bind_param('s', $username);
$stmt->execute();
$stmt->bind_result($username, $password);
$stmt->store_result();
if ($stmt->num_rows == 1) { //To check if the row exists
  if ($stmt->fetch()) { //fetching the contents of the row
    if (password_verify($pwd, $password)) {
      $_SESSION['username'] = $username;
      echo 'Success!';
      exit();
    } else {
      echo "INVALID PASSWORD!";
    }
  }
} else {
  echo "INVALID USERNAME";
}
$stmt->close();