Question

The following code produces the result “I don’t understand this”. Any ideas why? If two strings are the same length, match from their first character, and in fact are visually equal, why are they not equal with the equality operator??

$userid = (int) $_POST['username'];
$password = trim($this->input->post('password'));
$hashed = trim(md5($password . $this->salt));
$success = false;
if( $this->users[$userid]->password == $password ) {
    $success = true;
}
else {
    if( strpos($hashed, $this->users[$userid]->password) === 0 && 
        strlen($hashed) == strlen($this->users[$userid]->password) ) {
        echo "I don't understand this";
    }
}

Please ignore the advisability of using md5 to hash passwords in answering this.

Uses PHP5.3.2

Answer 1

I’m thinking you’re storing the password as a hash? You need to compare the user’s password to the hash then, not the password itself.

Change this:

if( $this->users[$userid]->password == $password ) {

to this:

if( $this->users[$userid]->password == $hashed ) {