How do you compare a password to a stored password in a database?

Hey, Kevin, thanks for getting back to me. Yeah!, I thought that might be the issue. So where and how would I hash the password that the user enters, so that I can compare it to the database password?

Would it be:

SHA1($password = mysqli_real_escape_string($connection, trim($_POST['password'])));

I'm not sure how to go about it

I var_dumped $password and $dbpassword - the $dbpassword shows a string of 20 characters, but $password shows a string of 40 characters. As if its been hashed twice... I cant seem to find a reason.

I have a login and sign up form that use the exact same name attributes - could that be a reason? are they conflicting with each other?

Thanks

How is the password getting hashed in the first place? Are you building off of someone elses code? That will help track this down.

A log in and sign up form that use the same name attributes is fine, since you can only submit one form at a time. You may just want to separate the logic that handles each form, since what you do with a sign up form and login form would be different.

Here is some light reading how PHP suggests you handle passwords: http://php.net/manual/en/faq.passwords.php Knowing how the password is being hashed when signing up will help.

Hey, yeah, I've pieced together the code from a new different sources.

initially, I hashed the password when they're inserted into the database

     $sql_signUp = "INSERT INTO login (username, email, passcode) VALUES('$username', '$email', SHA1('$password'))";

I doubled checked, and the password was hashed and inserted into the database

I then bring back everything in the row that relates to the username the user supplies, and compare it against the database. I then store the username/password from the database and compare them against the supplied username/password

<?php

    include("inc/dbconnection.php"); 

    //check for form submission
    if($_SERVER['REQUEST_METHOD'] == 'POST') {

        $errors = array();

        //check for username
        if(empty($_POST['username'])) {
            $errors = "You forgot to enter your Username";
        } else {

        $username = mysqli_real_escape_string($connection, trim($_POST['username']));
        }


         //check for password
        if(empty($_POST['password'])) {
            $errors[] = "You forgot to enter your password";
        } else {

            $password = mysqli_real_escape_string($connection, trim($_POST['password']));
        }

        if(empty($errors)) {

            $sql_login = "SELECT * FROM login WHERE username = '$username'";

            $result = mysqli_query($connection, $sql_login);

            if(mysqli_num_rows($result) == 1) {


                while($row = mysqli_fetch_assoc($result)) {

                    $dbusername = $row['username'];
                    $dbpassword = $row['passcode'];

                } 

                if($username == $dbusername && $password == $dbpassword) {
                    echo "Welcome " . $username . " you're now logged in" . "<br>";
                } else {
                    echo "incorrect username/password" . "<br>";
                }

            } else {

                echo "Account not found" . "<br>";
            }


        }

    }


?>

when you mentioned about comparing the plain text password against the hashed password, I then tried a few things to hash the password being supplied. I then var_dumped the $dbpassword and $password - the $password showed a string of 40 characters, whereas the $dbpassword showed a string of 20 characters - So I think its hashing the supplied password twice...

This is what I did to turn the plain text password into a hashed version:

$password = sha1(mysqli_real_escape_string($connection, trim($_POST['password'])));