0

And here's the latest change to my login process. I want to verify if the user's input matches with the hashed password that has been stored in the database. 

if(!isset($error)){
        //Use the input username and password and check against 'users' table

        $query = mysql_query("SELECT * FROM users 
        WHERE username = '".mysql_real_escape_string($user_input)."' OR email = '".mysql_real_escape_string($user_input)."' LIMIT 1") 
        or die(mysql_error());
        $count_row = mysql_num_rows($query);
        $row = mysql_fetch_assoc($query);




        if($count_row == 1){
        $hashed_password = $row['password'];
        if(! password_verify($password, $hashed_password)){
            $error[] = "Login failed! Please check your entered email and/or password";
            } else if($row['active'] < 1){
            $error[] = "Account has not been activated.";
            }else if($row['active'] == 1){
            // Do nothing
            } else {
            //write user data into PHP SESSION

This is my latest code. Any help is appreciated. Thanks in advance.

Samuel Asor
  • 480
  • 8
  • 25
  • Could you please lighten your code a little by creating a [mcve](http://stackoverflow.com/help/mcve) ? It will be easier to see the problem – merours Jul 22 '15 at 12:10
  • I think I've made the code as light as possible. @fxm, can you please check now? – Samuel Asor Jul 22 '15 at 13:45
  • Thanks ! I think I found something (see my answer) but do not hesitate to shorten your code even more : I see a lot of non related elements (error management, dead code, redirection…). – merours Jul 23 '15 at 07:36

1 Answers1

0

You're hashing the user password with this :

$password = password_hash($password, PASSWORD_BCRYPT);

However, during the login phase, you're doing the following :

$password = strtolower($email) . $password;

Since you're comparing the hashed of two different String, you won't get what you want.

merours
  • 4,076
  • 7
  • 37
  • 69
  • Thanks for the reply @fxm. I found a way round it, but I now have another challenge. The password_verify function doesn't seem to work. I can't verify the user's input with the one stored in the database. Here's what I now have: – Samuel Asor Jul 23 '15 at 18:30