I am creating an website with an user login system. For the authentification I use php password_hash() and password_verfiy().
In my code for the passwordRecovery I found an error. I am creating an random password and saving this with password_hash() to the database. I also send the user an email with the not hashed new password. But the authentification is not working.
At the end of the script I also printed the password and the hashed password and the printed hashed password and the hashed password in the database are different.
$zeichen = '0123456789abcdefghijklmnopqrstuvwxyz';
$newPassword = '';
$anz = strlen($zeichen);
for ($i=0; $i<16; $i++) {
$newPassword .= $zeichen[rand(0,$anz-1)];
}
... (some other code) ...
$sql = "UPDATE user SET password = :password WHERE email = :email";
$para = array(
'password' => password_hash($newPassword, PASSWORD_DEFAULT),
'email' => $email
);
DATABASE->SEND_FUNCTION(); //not a real function
... (some other code) ...
echo $newPassword;
echo password_hash($newPassword, PASSWORD_DEFAULT);
As you can see, I create a new password first and the save it hashed to the database. At the end I echo both forms of the password. echo $newPassword
gives me the same string I can the in my "New Password email". But echo password_hash($newPassword, PASSWORD_DEFAULT);
shows me a different string than I can see in my database.
Thank you guys for your help in advance. Im pretty lost.
Aucun commentaire:
Enregistrer un commentaire