Question

I am having problem with bcrypt hash method and mysql. I’m using the Bcrypt class from this answer.

I am creating login script and checking, if password is
correct. I am comparing password from input and hashed
password from DB.

$username= $_POST['username']; //username from input
$pass= $_POST['pass'];         //username from input

$query= mysql_query("SELECT pass FROM users WHERE username='$username'");
    $row=  mysql_fetch_row($query);

$row[0];// hashed password, I echo $row[0] and it shows correct hashed password

$bcrypt = new Bcrypt(15);
$isGood = $bcrypt->verify($pass, $row[0]);

if ($isGood){
echo "Authentication succeeded";
          }
else { 
    echo"Authentication failed";
   }

Even $pass is correct, I always get ‘Authentication failed’.
Any ideas, what can be wrong?

Thank you in advance.

Answer 1

The pass column in your users table is not wide enough to store the complete hash; it should be at least 60 characters wide, i.e. VARCHAR(60).

Btw, you should check out PasswordLib as well, written and maintained by ircmaxell, which also supports Bcrypt quite well.