Using password_verify in PHP

Question

I am developing a login system for an iOS app.

This is part of the PHP script that I am using to send a JSON response to the app:

if(isset($_POST['correo']) && isset($_POST['pass']) && $_POST['key'] == "123456")
{


    $password = $_POST['pass'];



    $q = mysqli_query($mysqli,"SELECT * FROM users WHERE email = '".$_POST['correo']."' AND 
    encrypted_password = '".$_POST['pass']."'") or die (mysqli_error());

    if(mysqli_num_rows($q) >= 1){
        $r = mysqli_fetch_array($q);

// this is the hash of the password in above example
            $hash = $r['encrypted_password'];

            if (password_verify($password, $hash)) {

                $results = Array("error" => "1","mensaje" => "su ID es ".$r['id'],"nombre" => $r['nombre'],"apellidos" => $r['apellidos'],"email" => $r['email'],
        "imagen" => $r['imagen'],"unidad" => $r['unidad']);

            } else {
                $results = Array("error" => "2","mensaje" => " acceso denegado ");
            }

    }else{
        $results = Array("error" => "3","mensaje" => "no existe");
    }

}

echo json_encode($results);

My issue is about using password_verify in PHP. I want to know if it should work as it is in the script or not, then the JSON response is not received in the app.

Thank you

your mysqli_query will always return empty result, because you pass to query unencrypted value and trying to get it equal to encrypted `encrypted_password = '".$_POST['pass']` — diavolic, Aug 24 '17 at 03:59
How did you store the user passwords originally? `encrypted` != `hahsed` (it should be hashed). — chris85, Aug 24 '17 at 04:01
@diavolic, you are right, that is the issue, I have removed encrypted_password = '".$_POST['pass'] from the query and it works. — mvasco, Aug 24 '17 at 04:07
@prakashtank WAT http://php.net/manual/en/function.password-verify.php — zerkms, Aug 24 '17 at 04:08

fortune · Accepted Answer · 2017-08-25T04:50:50.477

You don't need to match password in WHERE condition, something like:

$q = mysqli_query($mysqli,"SELECT * FROM users WHERE email = '".$_POST['correo']."'") or die (mysqli_error());

        if(mysqli_num_rows($q) >= 1){
                $r = mysqli_fetch_array($q);



                // this is the hash of the password in above example
                $hash = $r['encrypted_password'];

                //you need to match the password from form post against password from DB using password_hash    

                if (password_verify($password, $hash)) {

To prevent SQL Injection use parametrized queries ref: How can I prevent SQL injection in PHP?

... and SQL injection here, `WHERE email = '".$_POST['correo']."'"` — chris85, Aug 24 '17 at 13:32

Using password_verify in PHP

1 Answers1