mysql - Why is PHP PDO not pulling anything from my database (More specifically the UserPassword Column)

I want to pull the user's hash (saved under UserPassword) Picture of UserPassword column in DB and run it through password_verify(). The problem is, it doesn't return anything. Here's my code: HTML:

   <div class="userInfo">
      <form method="post">
        <p>Username: </p>
        <input type="text" name="Username" required>
        <p>Password: </p>
        <input type="password" name="Password" required>
        <br><br>
        <input type="submit" name = "submit" value="Log In"></button>
      </form>
    </div>
Copy code

PHP:

<?php
    if(isset($_POST['submit'])) {
      $tblusername = $_POST['Username'];
      $tblpasswordU = $_POST['Password'];

      $servername = "localhost";
      $username = "mealplan";
      $password = "";
      
      try {
        $conn = new PDO("mysql:host=$servername;dbname=mealplan", $username, $password);
        $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        $stmt = $conn->prepare("SELECT UserName FROM tblUsers WHERE UserName = :tblusername");
        $stmt->bindParam(':tblusername', $tblusername);
        $stmt->execute();

        if($stmt->rowCount() > 0){
        }else{
          die("Incorrect Username or Password");
        }
        $stmt = $conn->prepare("SELECT UserPassword FROM tblUsers WHERE UserName = :username");
        $stmt->bindParam(':username', $tblusername);
        $row = $stmt->fetch(PDO::FETCH_ASSOC);
        if (password_verify($tblpasswordU, $row['UserPassword']) == true) {
            echo "Signed in successfully";
        } else {
            die("Incorrect username or password");
        }
      } catch(PDOException $e) {
        echo "<style>.hidden { visibility: visible; } .shown { visibility: hidden; font-size: 0px }</style>";
      }
    }
    ?>
Copy code

Me echoing the Hash and Username were part of me testing. Here's the output: Incorrect Username or Password [] [123] (123 being my test user)

Quick note: $tblpasswordU is the unverified password the user put in.

Didn't find the answer?

Our community is visited by hundreds of web development professionals every day. Ask your question and get a quick answer for free.