php - Check phpass is correct on my existing login page -
i'm trying add phpass website no matter can't $check boolean return true let me log in, far i've managed encrypt password , store on database checking against failing.
<?php if(isset($_post['login'])){ $em = $_post['email']; // password form input $pw = $_post["password"]; // passwords should never longer 72 characters prevent dos attacks if (strlen($pw) > 72) { die("password must 72 characters or less"); } // in case hash isn't found $stored_hash = "*"; // retrieve hash stored earlier $stored_hash = "this hash stored earlier"; // check password correct, returns boolean $check = $hasher->checkpassword($pw, $stored_hash); if ($check) { // passwords matched! show account dashboard or $result = $con->query("select * user email='$em' , password='$pw'"); $row = $result->fetch_array(mysqli_both); session_start(); $_session["userid"] = $row['userid']; header('location: account.php'); } else { // passwords didn't match, show error header('location: fail.php'); } } because i've been trying add existing login wonder if have excess code breaking it? or maybe messed no matter try when logging in thing load is
header('location: fail.php');:| thanks in advance!
edit: right, have register file saves hashed password database:
if(isset($_post['register'])){ session_start(); $fname = $_post['first_name']; $lname = $_post['last_name']; $email = $_post['email']; // in case, password retrieved form input $pw = $_post["password"]; // passwords should never longer 72 characters prevent dos attacks if (strlen($pw) > 72) { die("password must 72 characters or less"); } // $hash variable contain hash of password $hash = $hasher->hashpassword($pw); if (strlen($hash) >= 20) { // store hash somewhere such database // code tutorial focuses on hashing passwords $sql = $con->query("insert user (fname, lname, email, password)values('{$fname}','{$lname}', '{$email}', '{$hash}')"); } else { // went wrong } echo $hash; // $storepassword = password_hash($pw, password_bcrypt, array('cost' => 10)); header('location: login.php'); //redirect here when registering and wish read database, compare password entered etc.
how pull info mysqli db compare it? , make work?
this tutorial following: https://sunnysingh.io/blog/secure-passwords
if(isset($_post['login'])){ $em = $_post['email']; // password form input $pw = $_post["password"]; // passwords should never longer 72 characters prevent dos attacks if (strlen($pw) > 72) { die("password must 72 characters or less"); } $result = $con->query("select * user email='$em'"); $row = $result->fetch_array(mysqli_both); if ($row) { // check password correct, returns boolean $check = $hasher->checkpassword($pw, $row['password']); if ($check) { // passwords matched! show account dashboard or session_start(); $_session["userid"] = $row['userid']; header('location: account.php'); exit; } } // passwords didn't match, show error header('location: fail.php'); }
Comments
Post a Comment