-1
// Define variables and initialize with empty values
$password = $new_password = $confirm_password = "";
$current_password_err = $new_password_err = $confirm_password_err = "";

// Processing form data when form is submitted
if ($_SERVER["REQUEST_METHOD"] == "POST") {

    // getting data from the database
    $stmt = $datalink->prepare('SELECT username, Password FROM users WHERE id = ?');
    // In this case we can use the account ID to get the account info.
    $stmt->bind_param('i', $_SESSION['id']);
    $stmt->execute();
    $stmt->bind_result($username, $password,);
    $stmt->fetch();
    $stmt->close();

    $results = mysqli_query($datalink, "SELECT username, password FROM users");
    $users = mysqli_fetch_all($results, MYSQLI_ASSOC);

    $ID = $_SESSION["id"];
    $sql = mysqli_query($datalink, "SELECT * FROM users where id='$ID' ");
    $row = mysqli_fetch_array($sql);

    if (password_verify($password, $_POST["current_password"])) {
        if (($_POST["current_password"]) != $password) {
            $current_password_err = "Please make sure your current password is correct.";
        }
    }

The above part of code I use it to retrieve the logged in user and use the id to bind with the password. The stored password in the database is set with a hashing algorithm: $2y$10$9R/KTjISn4a5EKXY0mXmdelUnXTAzepc27LKX2yk.T2mrHsOiNwY.

I discovered I cannot compare the current entered password with the already hashed password within the database because the hashing differs and is always unique.

Dharman
  • 26,923
  • 21
  • 73
  • 125
Mutika
  • 9
  • 2
  • 1
    `password_verify` should be called with the user entered password and the hash from the database. – Nigel Ren May 29 '22 at 18:44
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) – Dharman May 29 '22 at 18:49
  • It looks like you inverted parameters to `password_verify`. Closing as typo – Dharman May 29 '22 at 18:51

0 Answers0