Newbie php question with hashing passwords and user login

Question

Here is my create account mysql query. For the sake of ease I have left out salting.

$q = $dbc -> prepare("INSERT INTO accounts (username, email, password) 
                      VALUES (?, ?, ?)");
$q -> execute(array($_POST['username'], $_POST['email']
                        ,hash('sha256', $_POST['password'])));

Which does what I want, inserts a hashed password into the database, now my login script;

if ($count == 1 && $info['password'] === hash('sha256', $_POST['password']) 
                && $info['logcount'] != -1) { // successful login

This statement always returns false, I have tried different operates ie (=, ==), I am sure it is a simple solution.

Also if you have any good salting techniques please share :)

Thanks.

On a sidenote: [A little reading on hashing passwords](http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html). — Czechnology, Apr 16 '11 at 14:31
Did you `print_r($info)` and `echo hash('sha256', $_POST['password'])`? — Clodoaldo Neto, Apr 16 '11 at 14:40
(($count == 1) && ($info['password'] == hash('sha256', $_POST['password'])) && ($info['logcount'] != -1))) *pressed enter too soon* — Johan, Apr 16 '11 at 14:42
@kakoa no I only ever use echo, if that matters? I thought stick to one or the other, I prefer echo. — Basic, Apr 16 '11 at 14:52
@Johan no luck, this has baffled me, I have used this method over and over, maybe it has something to do with PDO? — Basic, Apr 16 '11 at 14:54
Try using sha2('password') instead of hash('sha256','password'). — Johan, Apr 16 '11 at 21:42

score -1 · Answer 1 · answered Apr 16 '11 at 14:41

-1

Why do you make type checking with ===? Maybe just

$info['password'] == hash('sha256', $_POST['password'])

?

answered Apr 16 '11 at 14:41

miholeus

1,537
1
9
8

Read the question it says: `I have tried different operates ie (=, ==),` – Johan Apr 16 '11 at 14:45
For php hash salts see the question: http://stackoverflow.com/questions/401656/secure-hash-and-salt-for-php-passwords – Johan Apr 16 '11 at 21:39

Newbie php question with hashing passwords and user login

1 Answers1