How Can i create a Secure SignIn Portal In PHP after Using Password Hash on SignUp Page.
Tags: php, sql, javascript
Published: 2021-03-19 17:46:42

Please fellow **Devs**, i just created a Signup(Registration) Portal in PHP using **password** Hash to store my password in the **Database**, but i cannot Login to the **welcome page** because the password passed from the login page is not the same as the Hashed password in the database.
Here is the code below:
someone should please tell me whats wrong, thanks.


###### FORM
```
<?php
include_once('../public/header.php');
include('../validate/login.php');
?>

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <link rel="stylesheet" href="../public/styles/style.css">
    <title>student login</title>
</head>


<body>

    <div class="container ml-lg-5 mr-lg-5">
        <div class="row ml-lg-5 mr-lg-5 p-lg-5">
            <div class="col ml-lg-5 mr-lg-5 p-lg-5 shadow">
                <form action="" method="POST">
                    <div class="text-danger"><?php echo $err_msg ?></div>
                    <label for="regno">Reg No</label>
                    <input type="text" name="regno" class="form-control">
                    <div class="text-danger"><?php echo $regno_err ?></div>

                    <label for="password">Password</label>
                    <input type="password" name="password" class="form-control">
                    <div class="text-danger"><?php echo $password_err ?></div>

                    <input type="submit" value="LOGIN" class="btn btn-outline-primary">
                </form>
            </div>
        </div>
    </div>


</body>

</html>
```

######FORM VALIDATION CODE
```
<?php
$err_msg = $regno_err= $password_err= "";
if($_SERVER["REQUEST_METHOD"] == "POST"){

    if ( !isset($_POST['regno'], $_POST['password']) ) {
        // Could not get the data that should have been sent.
        $err_msg='Please fill both the username and password fields!';
    };
    
	if(empty(trim($_POST['regno']))){
	$regno_err="please fill in regno";
	}elseif ($stmt = $conn->prepare('SELECT * FROM user WHERE regno = ?')) {
        // Bind parameters (s = string, i = int, b = blob, etc), in our case the username is a string so we use "s"
        $stmt->bind_param('s', $_POST['regno']);
		$stmt->execute();
        // Store the result so we can check if the account exists in the database.
        $stmt->store_result();

		if($stmt->num_rows == "false"){
			$regno_err= "user does not exist";
		}else{
			$regno=$_POST['regno'];

			$sql = "SELECT * From user WHERE regno = '{$regno}' ";
        	$query = mysqli_query($conn, $sql);

			if(!$query){
				die('unable to query'.$conn->error);
			}
			

			 while($row = mysqli_fetch_array($query)) {
                    $id            = $row['id'];
                    $username     = $row['username'];
					$regno_in	   =$row['regno'];
                    $email         = $row['email'];
                    $department   = $row['department'];
                    $pass_word     = $row['password'];
                }

			

			$password=password_verify($pass_word,$_POST['password']);
			if($regno_in ==$regno && $pass_word == $password){
				echo "you are welcome";
				$_SESSION['password'] = $pass_word;
	
				echo "your email is:".$_SESSION['password'];
			}else{
				echo "password does not match db";
			}

			}

		$stmt->close();	
		}
    }$conn->close();
?>
```