phpass CheckPassword function always returns false, while trying to login. Newbie issue

1.5k views Asked by At

Been trying to find solution in forums, and in stack's questions, but no results so you are my last hope. I'm using phpass for password encryption, sign up script works just fine, but when I try to login and use CheckPassword function it always returns false. I'm adding my both php scripts:

SIGN UP:

 <?php 
 require 'phpass-0.3/PasswordHash.php';
 require 'config.php';

 $email = $_POST['email'];
 $confirmed_email = $_POST['confirmed_email'];
 $username = $_POST['username'];
 $password = $_POST['password'];



 if ($_SERVER['REQUEST_METHOD'] === "POST") {

 if(!preg_match("^[a-z0-9,!#\$%&'\*\+/=\?\^_`\{\|}~-]+(\.[a-z0-9,!#\$%&'\*\+/=\?\^_`\{\|}~-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*\.([a-z]{2,})$^", $email))
 {
    $errors[] = "Incorrect email format.";
 }

 if (($email)!==($confirmed_email))
 {
    $errors[] = "Emails do not match";
 }


 if ((strlen($username) < 5) || (!ctype_alnum($username)))
 {
    $errors[] = "Username must be min 6 signs and only include 0-9, A-Z characters.";
 }

 if ((strlen($password) < 7) || (!ctype_alnum($password)))
 {
    $errors[] = "Password must be min 8 signs and only include 0-9, A-Z characters.";
 }

 $stmt = $db->prepare('SELECT * FROM users WHERE username = ? LIMIT 1');
 $stmt->bind_param('s', $username);
 $stmt->execute();
 $stmt->store_result();

 if($stmt->num_rows == 1)
 {
    $errors[] = "Username is taken.";
 }


 else if (!count($errors)) {
 $hasher = new PasswordHash(8, false);
 $hash = $hasher->HashPassword($password);
 if (strlen($hash) >= 20) {
 $stmt = $db->prepare('insert into users (username, email, password) values (?, ?, ?)');
 $stmt->bind_param('sss', $username, $email, $hash);
 $stmt->execute();
 $stmt->close();
 $db->close();
     }
 }

   Foreach($errors as $v) print "$v <br/>";
 }

 ?>

LOGIN:

<?php
include 'config.php';
require 'phpass-0.3/PasswordHash.php';

if(isset($_POST['email'], $_POST['password'])) { 
$email = $_POST['email'];
$password = $_POST['password'];




 $stmt = $db->prepare("SELECT id, username, password FROM users WHERE email = ? LIMIT 1");
 $stmt->bind_param('s', $email); 
 $stmt->execute();
 $stmt->store_result();
 $stmt->bind_result($user_id, $username, $hash);
 $stmt->fetch();

 $stored_hash = $hash;
 $hasher = new PasswordHash(8, false);


 $check = $hasher->CheckPassword($password, $stored_hash);

 if ($check) {

 echo"Logged IN"; 

 } else {

 echo "SOMETHING'S WRONG";
   }
 }
 ?>

Please, do not pay attention to security issues, cause it's just a demo scripts and I'm still learning.

1

There are 1 answers

0
Josiah On

make sure the hashed password is 60 character, anything more will return false. I have the same issue and notice my first hashed password was 61 characters.