title: PHP password_hash(), password_verify()
body: <p>My registration script accepts a user's password and then uses PHP's password_hash function to encrypt the password, then places it in a database.  When I go to login using the just created user, I'm getting the error that checks if the passwords are the same or not.  In my case, they're not.  What am I doing wrong when I make the call to the password_verify function in the login script?</p>
  
  <p><strong>REGISTER</strong></p>
  
  <pre><code>if($_SERVER["REQUEST_METHOD"] == "POST"){
      function secure($data){
          $data = trim($data);
          $data = stripslashes($data);
          $data = htmlspecialchars($data);
          return($data);
      }
  
      $p_num = secure($_POST["p_number"]);
      $first_name = secure($_POST["first_name"]);
      $last_name = secure($_POST["last_name"]);
      $email = secure($_POST["email"]);
      $password = secure($_POST["pw"]);
      $verify_password = secure($_POST["pw_verify"]);
      $program = secure($_POST["program"]);
      $role = secure($_POST["role"]);
      $logged_in = 0;
      $registered = 0;
      $image = "../images/profile_placeholder.png";
  
      if($password != $verify_password){
          echo "Nope.  Passwords";
      }
      else{
          $registered = 1;
          $password = password_hash($password, PASSWORD_DEFAULT);
          $insert = "INSERT INTO `$user_table`(`user_id`, `first_name`, `last_name`, `password`, `image`, `email`, `program`, `role`, `logged_in`, `registered`) VALUES('" .$p_num ."', '" .$first_name ."', '" .$last_name ."', '" .$password ."', '" .$image ."', '" .$email ."', '" .$program ."', '" .$role ."', '" .$logged_in ."', '" .$registered ."')";
          $query = mysqli_query($connect, $insert);
          echo "Success!";
      }
  }
  </code></pre>
  
  <p><strong>LOGIN</strong></p>
  
  <pre><code>if($_SERVER["REQUEST_METHOD"] == "POST"){
      $p_num = $_POST["username"];
      $pwd = $_POST["password"];
  
      $query = "SELECT * FROM `$user_table` WHERE `user_id` = '$p_num'";
      $result = mysqli_query($connect, $query);
      while($row = mysqli_fetch_assoc($result)){
          $user_id = "{$row['user_id']}";
          $first_name = "{$row['first_name']}";
          $last_name = "{$row['last_name']}";
          $user_name = $first_name ." " .$last_name;
          $password = "{$row['password']}";
          $image = "{$row['image']}";
          $email = "{$row['email']}";
          $program = "{$row['program']}";
          $role = "{$row['role']}";
          $status = "{$row['logged_in']}";
          $registered = "{$row['registered']}";
          if(($user_id == $p_num) &amp;&amp; (password_verify($pwd, $password))){
              $_SESSION["id"] = $user_id;
              $_SESSION["user"] = $user_name;
              $_SESSION["program"] = $program;
              $_SESSION["pass"] = $password;
              $_SESSION["image"] = $image;
              $_SESSION["email"] = $email;
              $_SESSION["role"] = $role;
              $_SESSION["status"] = $status;
              $_SESSION["registered"] = $registered;
              $loggedin = "UPDATE `$user_table` SET `logged_in` = 1 WHERE `user_id` = '$user_id'";
          }
      var_dump($pwd);
      var_dump($password);
  }
  </code></pre>
  
  <p>Here is what I get when I do var_dump:</p>
  
  <pre><code>string(1) "1" string(16) "$2y$10$0aysCso3b"
  </code></pre>
  
  <p>So clearly, the passwords are not being matched together.  So, on the registration script, the password is hashed and sent to the database.  Then, when the user goes to login, the login script looks at the password the user entered to login, and then checks it against the hashed password in the database using password_verify.  Yet, the hashed password isn't accepting the un-hashed password as a match.  What I'm not understanding is, why?</p>