php - Check phpass is correct on my existing login page -


i'm trying add phpass website no matter can't $check boolean return true let me log in, far i've managed encrypt password , store on database checking against failing.

<?php  if(isset($_post['login'])){      $em = $_post['email'];      // password form input     $pw = $_post["password"];      // passwords should never longer 72 characters prevent dos attacks     if (strlen($pw) > 72) { die("password must 72 characters or less"); }      // in case hash isn't found     $stored_hash = "*";      // retrieve hash stored earlier     $stored_hash = "this hash stored earlier";      // check password correct, returns boolean     $check = $hasher->checkpassword($pw, $stored_hash);      if ($check) {     // passwords matched! show account dashboard or      $result = $con->query("select * user email='$em' , password='$pw'");      $row = $result->fetch_array(mysqli_both);      session_start();      $_session["userid"] = $row['userid'];      header('location: account.php');       } else {       // passwords didn't match, show error     header('location: fail.php');     }   } 

because i've been trying add existing login wonder if have excess code breaking it? or maybe messed no matter try when logging in thing load is

header('location: fail.php');:| 

thanks in advance!

edit: right, have register file saves hashed password database:

if(isset($_post['register'])){      session_start();     $fname  = $_post['first_name'];     $lname  = $_post['last_name'];     $email  = $_post['email'];      // in case, password retrieved form input     $pw = $_post["password"];      // passwords should never longer 72 characters prevent dos attacks     if (strlen($pw) > 72) { die("password must 72 characters or less"); }      // $hash variable contain hash of password     $hash = $hasher->hashpassword($pw);      if (strlen($hash) >= 20) {      // store hash somewhere such database     // code tutorial focuses on hashing passwords     $sql = $con->query("insert user (fname, lname, email, password)values('{$fname}','{$lname}', '{$email}', '{$hash}')");      } else {       // went wrong      }      echo $hash;  //  $storepassword = password_hash($pw, password_bcrypt, array('cost' => 10));        header('location: login.php'); //redirect here when registering 

and wish read database, compare password entered etc.

how pull info mysqli db compare it? , make work?

this tutorial following: https://sunnysingh.io/blog/secure-passwords

if(isset($_post['login'])){      $em = $_post['email'];      // password form input     $pw = $_post["password"];      // passwords should never longer 72 characters prevent dos attacks     if (strlen($pw) > 72) { die("password must 72 characters or less"); }      $result = $con->query("select * user email='$em'");      $row = $result->fetch_array(mysqli_both);      if ($row) {          // check password correct, returns boolean         $check = $hasher->checkpassword($pw, $row['password']);          if ($check) {             // passwords matched! show account dashboard or              session_start();              $_session["userid"] = $row['userid'];              header('location: account.php');             exit;         }     }       // passwords didn't match, show error     header('location: fail.php');  } 

Comments

Popular posts from this blog

routing - AngularJS State management ->load multiple states in one page -

python - GRASS parser() error -

post - imageshack API cURL -