PHP 7.2.1 … Password_Verify doesn't work [on hold]
PHP 7.2.1 … Password_Verify doesn't work [on hold]
I'm doing a blog. I've got a very simple formular to sign in and another one to connect. Of course i want to crypt the password. It's working for crypting when a new member sign in with password_hash($pass, PASSWORD_DEFAULT)
But when he wants to connect, password_verify($pass, $hash)
doesn't work and I always have a FALSE
for response so the member can't connect.
I saw a lot of response on this forum. None answers my problem.
In PHPMyADMIN the pass field is a VARCHAR (255)
.
Here is my code (only in the model ... i'm using POO & MVC).
For the SIGN IN :
password_hash($pass, PASSWORD_DEFAULT)
password_verify($pass, $hash)
FALSE
VARCHAR (255)
public function insertMembre($pseudo, $mail, $pass)
{
$pass = password_hash($pass, PASSWORD_DEFAULT); // Hash pwd
$sql = 'insert into T_MEMBRE (pseudo, mail, pass, date) values(?, ?, ?, ?)';
$date = date(DATE_W3C); // Récupère la date courante
$this->executerRequete($sql, array($pseudo, $mail, $pass, $date)); // with hash pwd inside
}
And the code when connecting
public function getAdminMembre($pseudo, $pass)
{
$resultat = $this->executerRequete("select * from T_MEMBRE where pseudo= '$pseudo'");
$resultat = $resultat->fetch(PDO::FETCH_OBJ);
$hash = $resultat->pass;
$verify = password_verify($pass, $hash);
if($verify) {
I always get FALSE
when testing password_verify()
with a var_dump()
. So the connection to the blog is impossible.
I don't know what's the problem. I tested everything with some var_dump()
and everything seems to be correct (I have the right crypted password from database, i have the right password 123 coming from the form ... etc). The password is 123. I can't do more simple and my syntax is exactly equal at the php Manual.
FALSE
password_verify()
var_dump()
var_dump()
Here are my Var_dump of pwd from the formular
string(3) "123"
Var_dump of the pwd extract from database
string(60) $2y$10$Sv6SiQrrMoLOZVPHjPIYieHt/zcpMiEqVsN0ZS0rtJJt.LUmWiJl.
pwd in the database
$2y$10$Sv6SiQrrMoLOZVPHjPIYieHt/zcpMiEqVsN0ZS0rtJJt.LUmWiJl.
Var_dump of password_verify
bool(false)
Update:
The error_log indicates :
/Controleur/ControleurMembre.php(35): Membre->insertMembre('Aldo', 'aldo@gmail.com', '$2y$10$0K1hLrXx...')
/Controleur/Routeur.php(181): ControleurMembre->enregistrerMembre('Aldo', 'aldo@gmail.com', '$2y$10$8mcZOCGr...')
We can see a difference between the two PWD values even if the code is uncomplete.
Here is the method executerRequete :
protected function executerRequete($sql, $params = null) {
if ($params == null) {
$resultat = $this->getBdd()->query($sql); // exécution directe si pas de paramètre
}
else {
$resultat = $this->getBdd()->prepare($sql); // requête préparée si paramètres (empêche les injections SQL)
$resultat->execute($params);
}
return $resultat;
}
This question appears to be off-topic. The users who voted to close gave this specific reason:
The functions referenced in your Update are two completely different methods, can you explain why one is
Membre->insertMembre(
and another is ControleurMembre->enregistrerMembre(
?– Martin
Jun 29 at 11:36
Membre->insertMembre(
ControleurMembre->enregistrerMembre(
Because in the controler it's called enregistreMembre who calls the method insertMembre. They are differents french word nearly same but different. It's for not melting the differents functions. If the names are too differents you can confuse.
– B.GERMAIN
Jun 29 at 11:43
My router is a 347 lines file so i didn't notice that it was still written "$_POST ['pass'] = password_hash($_POST['pass'], PASSWORD_DEFAULT);". For the issue i deleted the same line in my MODEL file called Membre. I tried to create a new member and it worked. In a second part i tried to call a member created before the correction and was not working. This was a confirmation of a wrong pwd sent in the database. Now each new member has a good pwd and it's perfectly working. Again ... THANK YOU SO MUCH.
– B.GERMAIN
Jun 29 at 12:27
That's good news, it may be best for you to delete this question as it will be of no use to anyone else, now that your issue is solved. I'm glad I could help
:-)
– Martin
Jun 29 at 12:48
:-)
Comments are not for extended discussion; this conversation has been moved to chat.
– Yvette Colomb♦
Jun 29 at 11:04