title: password_verify php not match
body: <p>I try to check the password with the function password_verify with the posted user password and the hash from database.</p>
  
  <p>First, how I generate the password and hash:</p>
  
  <pre><code>$user_password = $this-&gt;generate_password();
  
  private function generate_password($length = 8)
  {
   $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&amp;*()_-=+;:,.?";
   $password = substr( str_shuffle( $chars ), 0, $length );
   return $password;
  }
  
  define("HASH_COST_FACTOR", "10");
  $hash_cost_factor = (defined('HASH_COST_FACTOR') ? HASH_COST_FACTOR : null);
  $user_password_hash = password_hash($user_password, PASSWORD_DEFAULT, array('cost' =&gt; $hash_cost_factor));
  
  
  $sql = "INSERT INTO users (user_name, user_password_hash, user_email, user_creation_timestamp)
  VALUES (:user_name, :user_password_hash, :user_email, :user_creation_timestamp)";
  $query = $this-&gt;db-&gt;prepare($sql);
  $query-&gt;execute(array(':user_name' =&gt; $user_name,
                        ':user_password_hash' =&gt; $user_password_hash,
                        ':user_email' =&gt; $user_email,
                        ':user_creation_timestamp' =&gt; $user_creation_timestamp));
  $count =  $query-&gt;rowCount();
  if ($count != 1) {
     $_SESSION["feedback_negative"][] = FEEDBACK_ACCOUNT_CREATION_FAILED;
   return false;
  }
  
    if ($this-&gt;sendUserpassword($user_email, $user_password)) {
        $_SESSION["feedback_positive"][] = FEEDBACK_ACCOUNT_SUCCESSFULLY_CREATED;
        return true;
    } else {
        $query = $this-&gt;db-&gt;prepare("DELETE FROM users WHERE user_id = :last_inserted_id");
        $query-&gt;execute(array(':last_inserted_id' =&gt; $user_id));
        $_SESSION["feedback_negative"][] = FEEDBACK_PASSWORD_MAIL_SENDING_FAILED;
        return false;
    }
  private function sendUserpassword($user_email, $user_password)
  {
    $mail = new PHPMailer;
  
    if (EMAIL_USE_SMTP) {
        $mail-&gt;IsSMTP();
        $mail-&gt;SMTPDebug = PHPMAILER_DEBUG_MODE;
        $mail-&gt;SMTPAuth = EMAIL_SMTP_AUTH;
        if (defined(EMAIL_SMTP_ENCRYPTION)) {
            $mail-&gt;SMTPSecure = EMAIL_SMTP_ENCRYPTION;
        }
        $mail-&gt;Host = EMAIL_SMTP_HOST;
        $mail-&gt;Username = EMAIL_SMTP_USERNAME;
        $mail-&gt;Password = EMAIL_SMTP_PASSWORD;
        $mail-&gt;Port = EMAIL_SMTP_PORT;
        } else {
          $mail-&gt;IsMail();
        }
  
    $mail-&gt;From = EMAIL_PASSWORD_FROM_EMAIL;
    $mail-&gt;FromName = EMAIL_PASSWORD_FROM_NAME;
    $mail-&gt;AddAddress($user_email);
    $mail-&gt;Subject = EMAIL_PASSWORD_SUBJECT;
    $mail-&gt;Body = EMAIL_PASSWORD_CONTENT . '/' . $user_password;
  
    if($mail-&gt;Send()) {
      $_SESSION["feedback_positive"][] = FEEDBACK_PASSWORD_MAIL_SENDING_SUCCESSFUL;
      return true;
    } else {
      $_SESSION["feedback_negative"][] = FEEDBACK_PASSWORD_MAIL_SENDING_ERROR . $mail-&gt;ErrorInfo;
      return false;
    }
  }
  </code></pre>
  
  <p>Validate on login:</p>
  
  <pre><code>if (!isset($_POST['user_name']) OR empty($_POST['user_name'])) {
    $_SESSION["feedback_negative"][] = FEEDBACK_USERNAME_FIELD_EMPTY;
    return false;
  }
  
  if (!isset($_POST['user_password']) OR empty($_POST['user_password'])) {
    $_SESSION["feedback_negative"][] = FEEDBACK_PASSWORD_FIELD_EMPTY;
    return false;
  }
  
  $sth = $this-&gt;db-&gt;prepare("SELECT user_id,
                             user_name,
                             user_email,
                             user_password_hash,
                             user_active,
                             user_account_type
                             FROM   users
                             WHERE  (user_name = :user_name OR user_email = :user_name)");
  
  $sth-&gt;execute(array(':user_name' =&gt; $_POST['user_name'], ':provider_type' =&gt; 'DEFAULT'));
  $count =  $sth-&gt;rowCount();
  
  if ($count != 1) {
    $_SESSION["feedback_negative"][] = FEEDBACK_LOGIN_FAILED;
    return false;
  }    
  
  $result = $sth-&gt;fetch();
  
  //check via password_verify
  if (password_verify($_POST['user_password'], $result-&gt;user_password_hash)) {
    ...
    return true;
  } else {
    $_SESSION["feedback_negative"][] = FEEDBACK_PASSWORD_WRONG;
    return false;
  }
  </code></pre>
  
  <p>get always the password wrong message. I read this <a href="https://stackoverflow.com/questions/19855715/php-password-hash-and-password-verify-issues-no-match">php password_hash and password_verify issues no match</a> but I tested the hash string by hand to verify with literal string.</p>
  
  <p>The hashstring:
  $2y$10$SwSq7OukPpN/QJ8YOdKgquJQ28fQbNY1Q3JdTFnoe.2VxD/D2RXBS</p>
  
  <p>The password send by email:
  /f)1c(-JG</p>
  
  <p>tested by hand:</p>
  
  <pre><code>$hash = '$2y$10$SwSq7OukPpN/QJ8YOdKgquJQ28fQbNY1Q3JdTFnoe.2VxD/D2RXBS';
  $password = '/f)1c(-JG';
  
  if (password_verify($password, $hash)) {
      echo 'Password is valid!';
  } else {
      echo 'Invalid password.';
  }
  </code></pre>
  
  <p>prints Invalid password.</p>