Probably the problem is with your column length, from the manual: it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice). link
There are a variety of reasons why could be returning false, it can range from the setup of your table to the actual comparing of the password, below are the common causes of it failing.
The length of the password column in your table is too short:
PASSWORD_DEFAULT
then it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice).PASSWORD_BCRYPT
then it is recommended to store the result in a database column that is 60 characters becausePASSWORD_BCRYPT
will always result in a 60 character string or FALSE on failure.Another common cause is when developers try to "clean" the user's password to prevent it from being malicious, as a result, this causes the input to be different to what is being stored in the table. It is not even necessary to escape the input, you should use prepared statements instead. You shouldn't eventrim
the passwords as that could change that which was originally provided.
When usingpassword_verify
you need to compare the plaintext password with the hash from the database, not compare hashes (the implication here being that you need to have stored the hashed password of the user when they register):
<?php
$hashed = password_hash('test', PASSWORD_DEFAULT);
$password = 'test';
if (password_verify($password, $hashed)) {
echo 'success';
} else {
echo 'fail';
}
?>
In the instance that you are using a hardcoded hash and you are facing issues, ensure that you are using single quotes instead of double quotes when storing the value in the variable as the$
will be interpreted in when using double quotes:
<?php
// Undefined variable: QHpfI0MfQWjvsVQWRdFHSOX6WqG8LSf0iFGiKs0Fz0RvqhpFOpAKu :1
$incorrect = "$2y$10$QHpfI0MfQWjvsVQWRdFHSOX6WqG8LSf0iFGiKs0Fz0RvqhpFOpAKu";
$correct = '$2y$10$QHpfI0MfQWjvsVQWRdFHSOX6WqG8LSf0iFGiKs0Fz0RvqhpFOpAKu';
?>
Repl - Comment out respectively.
As per the documentation:
Caution It is strongly recommended that you do not generate your own salt for this function. It will create a secure salt automatically for you if you do not specify one.
As noted above, providing the salt option in PHP 7.0 will generate a deprecation warning. Support for providing a salt manually may be removed in a future PHP release.
Check the parameters order
Just to point something that happened to me, who was reading this same topic trying to solve my problem minutes ago, and can help you to solve the problem as well.
See if you are giving the parameters for password_verify() in the right order:
password_verify(string $password, string $hash)
password is the password you received by post or other method and are trying to validate.
hash is the hash that you want to compare the password to.(e.g. The password hash stored in your Data Base)
It happened to me that I inverted the order of the parameters, so the result wasn't coming as I expected to.
Simple steps to debug the issue:
Print out and write down exact values of the raw password and the hash during the registration phase. Something like
var_dump($password);
$hash = password_hash($password, PASSWORD_DEFAULT);
var_dump($hash);
then copy and paste the output into some text file.
Print out and write down exact values of the password provided during login phase and the hash returned from DB. Something like
var_dump($password);
var_dump($row['password']);
if(password_verify($password, $row['password'])) ...
And then simply compare those values. Ifpassword_verify()
fails, either raw passwords or hashes don't match. If raw passwords don't match then the entered password is either incorrect or was maimed during some useless "sanitization". If the hash returned from DB doesn't match, then it either was maimed during some useless "sanitization" or it was changed due to incorrect column properties in the database.
Our community is visited by hundreds of web development professionals every day. Ask your question and get a quick answer for free.
Find the answer in similar questions on our website.
Do you know the answer to this question? Write a quick response to it. With your help, we will make our community stronger.
PHP (from the English Hypertext Preprocessor - hypertext preprocessor) is a scripting programming language for developing web applications. Supported by most hosting providers, it is one of the most popular tools for creating dynamic websites.
The PHP scripting language has gained wide popularity due to its processing speed, simplicity, cross-platform, functionality and distribution of source codes under its own license.
https://www.php.net/
Welcome to the Q&A site for web developers. Here you can ask a question about the problem you are facing and get answers from other experts. We have created a user-friendly interface so that you can quickly and free of charge ask a question about a web programming problem. We also invite other experts to join our community and help other members who ask questions. In addition, you can use our search for questions with a solution.
Ask about the real problem you are facing. Describe in detail what you are doing and what you want to achieve.
Our goal is to create a strong community in which everyone will support each other. If you find a question and know the answer to it, help others with your knowledge.