truelogicINC truelogicINC - 7 months ago 17
PHP Question

The error is incorrect username or password even I've entered the correct credentials

I've created my own way of login.php using hash & salt. When I input new admin account, the password and seems to be working fine on my phpmyadmin but when I calling the hash and salt in my login, the "User doesn't exist" seems to be good. The error is always "Incorrect username & password" even I've entered the right crendentials. I've already used this script at my previous login system but I don't know why it's now working now.

Here's my login.php

<?php
include_once('config.php');
session_start();
$username = $_POST['username'];
$password = $_POST['password'];

$username = mysqli_real_escape_string($mysqli,$username);

$query = $mysqli->query("SELECT password,salt FROM admin WHERE username='$username'");

$numrows = mysqli_num_rows($query);

if($username == "" && $password =="") {
echo '<center>';
echo '<h3>Please Fill in the blank form</h3>';
echo '<button type="button" class="btn btn-primary" id="goback" >Log In Again</button>';
echo '</center>';
} else if($numrows!=0) {
$userData = mysqli_fetch_array($query, MYSQL_ASSOC);
$hash = hash('sha256', $userData['salt'] . hash('sha256', $password));

if($hash != $userData['password']) {
echo '<center>';
echo '<h3>Incorrent username or password</h3>';
echo '<button type="button" class="btn btn-primary" id="goback" >Log In Again</button>';
echo '</center>';
} else {
header('Location: firstpagesurvey.html');
}
} else {
die('
<center>
<h3>Username does\'t exists</h3>
<button type="button" class="btn btn-primary" id="goback" >Log In Again</button>
</center>
');
}
?>


Here's the create_admin action

<?php
include_once('config.php');
session_start();

$username = $_POST['username'];
$password = $_POST['password'];
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];

$hash = hash('sha256', $password);

function createSalt(){
$text = md5(uniqid(rand(), true));
return substr($text,0,3);
}

$salt = createSalt();

$password = hash('sha256', $hash.$salt);

$username = $mysqli->real_escape_string($username);

$query = $mysqli->query("INSERT INTO `admin`(`username`,`password`,`firstname`,`lastname`,`salt`) VALUES('$username','$password','$firstname','$lastname','$salt')");

$mysqli->close();

header('Location: success.php');

?>

Answer

in create page make hash( hash(password).salt) but login page make hash( salt.password).

in your create_admin action, you make hashed password

your code is

$password = hash('sha256', $hash.$salt); 
/*and*/
$hash is $hash = hash('sha256', $password);

this mean in create_page your hashing is hash( hash(password), salt)

but your login.php

your code is

$hash = hash('sha256', $userData['salt'] . hash('sha256', $password));

this mean in login your hashing is hash( salt, hash(password) )

in short, your hashing order between create_admin and login is wrong.

Comments