How do i add the password_hash function on a simple login system?

Question

I am using PHP and MySQL to create a login system. The page only requires the user to login and their is no option for them to register.

I have the passwords stored in my database already as plain text and i am aware this is not safe at all.

What steps would i take to make this more secure and hash the password that is already stored in the database?

Would i need to go back and alter my database?

Here is some code i am using at the moment:

if($_SERVER['REQUEST_METHOD'] == 'POST') {
    if (empty($_POST['username']) || empty($_POST['password'])) {
        $error = "Enter Username and Password";
    } else {    
        $username = $_POST['username'];
        $password = $_POST['password'];

        include('dbconx.php');

        $sql = "SELECT * from admin where password='$password' AND     username='$username'";
        $result = mysqli_query($con,$sql) or die(mysqli_error());
        $count = mysqli_num_rows($result);

        if ($count == 1) {
            $_SESSION['login_user'] = $username; // Initializing Session
            header("location: confirm.php"); // Redirecting To Other Page
        } else {
            $error = "Username or Password is incorrect";
        }
        mysqli_close($con); // Closing Connection
    }
}

**Always start by reading the manual** [`password_hash()`](https://secure.php.net/manual/en/function.password-hash.php) and [`password_verify()`](https://secure.php.net/manual/en/function.password-verify.php) There I even managed to keep it polite! — RiggsFolly, Mar 28 '18 at 20:53
`hash(method, $string);` http://php.net/manual/en/function.hash.php — Richard, Mar 28 '18 at 20:53
"*What steps would i take to make this more secure*" -- For **starters** you should be using [**prepared statements**](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) to prevent [**SQL injection**](https://en.wikipedia.org/wiki/SQL_injection). Also ensure that your database user only has the [**required privileges**](https://en.wikipedia.org/wiki/Principle_of_least_privilege). You can refer to [**this post**](http://stackoverflow.com/questions/60174) for further information on how to prevent SQL injection in PHP :) — Obsidian Age, Mar 28 '18 at 20:54
@Richard See https://secure.php.net/manual/en/book.password.php — RiggsFolly, Mar 28 '18 at 20:56
@Richard Maybe nothing but `password_hash()` uses a strong hash, generates a strong salt, and applies proper rounds automatically. So for most of us normal people that dont specialise in these things, it makes doing it right a default rather than relying on us to do the right thing — RiggsFolly, Mar 28 '18 at 21:09
You might need to alter the database. The length of your password column may need to be extended to accommodate the hash. — Don't Panic, Mar 28 '18 at 21:13

score 1 · Answer 1 · edited Mar 28 '18 at 21:19

The important points were already written in the comments. To sum it up:

password_hash and password_verify are the functions to use in PHP
You'd have to write a script which goes through all your already stored passwords (in plaintext) and hash them with password_hash and resave them to the database.
You should read about SQL-injections. Use (at least) mysqli_escape_string. Much, much better ist to use prepared statments. (http://php.net/manual/en/pdo.prepared-statements.php)
I don't know your database-structure, but normally you don't need to alter anything there, but you will have to check your password field is large enough to hold the hash VARCHAR(255) is recommended as password_verify() may get changed in future versions of PHP and this should be big enough to hold any future hashing output.

How do i add the password_hash function on a simple login system?

1 Answers1