Problem with login system - array

Question

Hello. I am creating a login system for study purposes.

I identified in the file that is not populating the array with the database information... and yes, I have already made sure that the email and password informed already exists in the database.

Follow login.php file:

<?php

require_once 'init.php';

// resgata dados digitados no formulario
$email = isset($_POST['email']) ? $_POST['email']: '';
$senha = isset($_POST['senha']) ? $_POST['senha']: '';
// Cria o hash da senha
$seg_senha = password_hash($senha, PASSWORD_DEFAULT);

// Verifica se os campos do form nao estao vazios
if(empty($email) || empty($senha)){
    echo 'Informe Email e Senha';
    exit;
}

// Comando no banco de dados
$pdo = db_connect();    // Abre conexão com o banco

$sql = "SELECT id, nome FROM usuarios WHERE email = :email AND senha = :senha";
// Cria query

$stmt = $pdo->prepare($sql);    // Prepare da query

$stmt->bindParam(':email', $email);
// Atribui valor do campo email no valor email da query
$stmt->bindParam(':senha', $seg_senha);
// Atribui valor do campo senha no valor senha da query

$stmt->execute();   // Execute na query

$arr = $stmt->fetchAll(PDO::FETCH_ASSOC);   // Cria array associativo

if(count($arr) <= 0){   // Verifica se existe elemento no array
    echo "<script language='javascript' type='text/javascript'>alert('Login e/ou senha incorretos');window.location.href='../login.php';</script>";
    exit;
}

// Pega o primeiro usuario
$user = $arr[0];

// Inicia a sessão
session_start();
$_SESSION['logged_in'] = true;
$_SESSION['user_id'] = $user['id'];
$_SESSION['user_name'] = $user['nome'];

header('Location: ../index1.php');

If I comment from the line if(count($arr) <= 0){ down, and put a var_dump($arr);below $arr = $stmt->fetchAll(PDO::FETCH_ASSOC); returns an empty array

C:\wamp64\www\ProjetoALPHA\core\login.php:33:
array (size=0)
  empty

Could someone help me?

Grateful!

Answer 1

This here will not practically generate the same hash that was written in DB:

$seg_senha = password_hash($senha, PASSWORD_DEFAULT);

and, among other things, that’s why the function is more secure than hashes simple. In addition to using hashes better, the function generates a salt random each time it is used.

Primitive and insecure password systems were made with this technique being tested in the question, and these are vulnerable to attacks from pre-calculated password tables.

To better understand, see this post:

How to hash passwords securely?

To understand that it doesn’t work, take this test:

echo password_hash( '123456', PASSWORD_DEFAULT)."<br>\n";
echo password_hash( '123456', PASSWORD_DEFAULT)."<br>\n";
echo password_hash( '123456', PASSWORD_DEFAULT)."<br>\n";
echo password_hash( '123456', PASSWORD_DEFAULT)."<br>\n";
echo password_hash( '123456', PASSWORD_DEFAULT)."<br>\n";

Check out on IDEONE.

You noticed that the password is the same, but the hash mute? That’s why generating the hash again while doing the SELECT no use.

Solution to your case:

The correct thing is you recover DB data with that user, and the hash, and only then test in PHP like this:

// ELIMINE ISSO DO LOGIN:
// $seg_senha = password_hash($senha, PASSWORD_DEFAULT);
// O password_hash só deve ser usado ao salvar uma senha, não ao ler.

$pdo = db_connect();
$sql = "SELECT id, nome, senha FROM usuarios WHERE email = :email";
$stmt = $pdo->prepare($sql);
$stmt->bindValue(':email', $email); // No caso o bindValue é mais adequado
$stmt->execute();

$arr = $stmt->fetchAll(PDO::FETCH_ASSOC);
if(count($arr) < 1) {
    ... USUARIO NAO EXISTE ...
} else if( password_verify( $senha, $arr[0]['senha'] ) ) {
    ... BEM VINDO AO SISTEMA ...
} else {
    ... SENHA ERRADA ...
} 

Or if you don’t want to give the tip if it was the user or password that got it wrong, to make attacks harder, change the end to

if( ( count($arr) < 1) || (!password_verify( $senha, $arr[0]['senha'])) ) {
    ... SENHA OU USUÁRIO ERRADO ...
} else {
    ... BEM VINDO ...
} 

In general, that’s it. Adjust for your specific case.

Handbook:

http://php.net/manual/en/function.password-verify.php