How to login with bcrypt

Question

I want to change my register/login pages from md5 to bcrypt. The register part is allright but I can't get the login part working good. I am trying to work with a bcrypt library;https://github.com/ircmaxell/password_compat/blob/master/lib/password.php.

The original login function(without md5) looks like this;

function login($username, $password) {
    $user_id = user_id_from_username($username);

    $username = sanitize($username);

    return (mysql_result
    (mysql_query
    ("SELECT COUNT(`user_id`) 
    FROM `users` 
    WHERE `username` = '$username' 
    AND `password` = '$password'"), 0) == 1) ? $user_id : false;
}

What I am trying to do is retrieve the database but with the original code is is not possible because of the mysql_result part. I thought for example that;

function login($username, $password) {

    $username = sanitize($username);

    $user_query = mysql_query("SELECT `password` FROM `users` WHERE `username` = '$username'");

    $row = mysql_fetch_assoc($user_query);

    $hash = $row['password'];

    password_verify($password, $hash);
}

would solve this problem, but it isn't.

Is there a solution without mysql_fetch_assoc() here or am I trying to retieve the database wrong?

Answer 1

You need to set up password_verify like so :

function login($username, $password) {
    $sql = "SELECT * FROM users WHERE username = :username"; // Select all info related to the USERNAME
    $loginQ = $dbh->prepare($sql); // Prepare your query
    $loginQ->bindParam(':username', $username); // Bind your variable
    $loginQ->execute(); // Execute (TRUE or FALSE)

    if ($loginQ) { // If TRUE
        if ($loginQ->rowCount() == 1) { // You should only be returning 1 row with 1 username
            $row = $loginQ->fetch(); // Fetch that row 
            $hash = $row['password']; // Use the row password and assign it to a variable 

            if (password_verify($password, $hash)) { // use passwd_compat function password_verify to check if it passes, if it does return TRUE
                return TRUE;
            }
        }
    }
}

Just from reading your code the issue I first noticed was that you are not returning a value whether it be

TRUE

or

FALSE

Also for another way to understand how to use password_verify you can also do it like so :

if (password_verify($form_password, $row['password'])) {
    $_SESSION['LoggedIn'] = TRUE;
    header("location: homepage.php");
} else {
   Echo "Wrong password or username please <a href='index.php'><b>Retry!</b></a>";
}

and the next issue I noticed is that you are using unsafe and old functions (mysql_)

To help you with the later of the issues above I made a PDO version for you to use which has many more positives then mysql_ does.

Then to set up PDO look at this answer (yes it is mine - there a lot of good answers out there so do some research) This gives your the steps from setting up the PDO instance to actually using it. Any questions just ask. More on PDO here.