Member Avatar for johnef_sh

I am using PHPASS to store password encrypted and compare when login.

here is the code

ob_start();
$userName = $password = "";
$userNameErr = $passwordErr = $loginErr = "";
$hasher = new PasswordHash(8, false);

if (isset($_POST['subEmployee'])) {
    if (empty($_POST['user_name'])) {
        $userNameErr = "User name is required";

    } else {
        $userName = check_input($_POST['user_name']);
        if (!preg_match("/^[0-9_a-zA-Z]*$/", $userName)) {
            $userNameErr = "Only letters, numbers and '_' allowed";
        }
    }
    if (empty($_POST['password'])) {
        $passwordErr = "Password is required";
    }else{
        $password = check_input($_POST['password']);
    }

    $active = 1;
    $loginUser = $db->prepare("SELECT password FROM users WHERE user_name=? AND activity=?");
    $loginUser->bind_param('si', $userName, $active);
    if ($loginUser->execute()) {
        $results = $loginUser->get_result();
        if ($results->num_rows == 1) {
            $row = $results->fetch_object();
            $stored_hash = "*";
            $stored_hash = $row->password;
            $check = $hasher->CheckPassword($password, $stored_hash);
            if ($check) {
                $_SESSION['name'] = $row->first_name;
                $_SESSION['userId'] = $row->id;
                $_SESSION['user'] = 1;
                print_r($_SESSION);
                header("Location:?pid=4");
            } elseif (!empty($_POST['user_name']) && !empty($_POST['password'])) {
                $loginErr = "'Invalid Login Information'";
            }
        }
    }
}

so far it always give the same message 'Invalid Login Information' I have made the registration form that store my password like this.

$hasher = new PasswordHash(8, false);
$hash = md5(rand(0, 1000));

if (empty($_POST['password'])) {
        $error ['passwordErr'] = "Password is required";
    } elseif (strlen($_POST['password']) < 8) {
        $error ['passwordErr'] = "<span class='notAllowed'>Chose password with at last eight characters</span>";
    } elseif (strlen($_POST['password']) > 72) {
        $error ['passwordErr'] = "<span class='notAllowed'>Password max 72 characters</span>";
    } elseif ($_POST['password'] !== $_POST['confirm']) {
        $error ['passwordErr'] = "Password don't matching";
    } else {
        $password = $hasher->HashPassword($password);
    }

when I checked my database the password seems hashed to me and the user name is there and everything is alright

but still getting this message as 'Invalid Login Information'.

does this two lines is right

$loginUser = $db->prepare("SELECT password FROM users WHERE user_name=? AND activity=?");
    $loginUser->bind_param('si', $userName, $active);

does the login code OK.

Thanks

  • 2 Contributors
  • 3 Replies
  • 257 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

Observed issues from 's snippets likely causing the constant "Invalid Login Information" message:

  • The prepared SELECT only pulls password, but later the code expects first_name and id from the same row. That mismatch can hide logic errors and makes successful login handling fail.
  • The registration snippet contains an unexplained md5(...) line; that may indicate inconsistent hashing or a leftover variable.
  • Common backend pitfalls (truncated hash column, different hash settings at registration vs login, or use of mysqli_stmt->get_result() without mysqlnd) can all make CheckPassword return false even when the plaintext is correct.

Practical fixes to apply immediately (examples show corrected field list and an alternative fetch flow):

$loginUser = $db->prepare(
  "SELECT id, first_name, password FROM users WHERE user_name = ? AND activity = ?"
);
$loginUser->bind_param('si', $userName, $active);

Alternative fetch if get_result() is unavailable:

$loginUser->execute();
$loginUser->bind_result($id, $firstName, $stored_hash);
if ($loginUser->fetch()) {
  // call hasher->CheckPassword($password, $stored_hash) here
}

Quick debug checklist (verify each item and log results temporarily): inspect the exact stored hash value and its length in the DB; confirm the registration code actually saved the same hashed output produced by the same PasswordHash settings; ensure the password column can hold the full hash (use VARCHAR(255) or TEXT); avoid double-hashing or accidental transformations (trims, encodings) before store/verify; confirm session_start() is called earlier; enable mysqli error reporting or inspect $db->error and the statement error properties.

's suggestion about using the password_compat polyfill or upgrading PHP is sound for longer-term safety; for now, follow the checklist above and re-run a controlled test user to isolate whether the problem is storage, retrieval, or verification.

Recommended Answers

All 3 Replies

Member Avatar for Member #120589

Not familiar with PHPass, Any reason you're using md5? It's generally accepted that it's past it's sell by date. Not recommended.

If you have php 5.5.0+, then you may wish to consider password_hash() and password_verify() using something like BCRYPT with a "cost" of 11 or 12.

Edited by Member #120589
Member Avatar for johnef_sh

Thanks for reply but what to do if I am using PHP 5.3.29 any other idea
thanks again

Member Avatar for Member #120589

Are you not able to shift your version up a few notches?

14 Aug 2014
The PHP development team announces the immediate availability of PHP 5.3.29. This release marks the end of life of the PHP 5.3 series. Future releases of this series are not planned. All PHP 5.3 users are encouraged to upgrade to the current stable version of PHP 5.5 or previous stable version of PHP 5.4, which are supported till at least 2016 and 2015 respectively.

Anyway, you can use https://github.com/ircmaxell/password_compat (thanks to veedeoo for the link).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.