title: php password_verify not working with database
body: <p>I am using php 5.4 with this backwards compatibility script: <a href="https://github.com/ircmaxell/password_compat/blob/master/lib/password.php">https://github.com/ircmaxell/password_compat/blob/master/lib/password.php</a></p>
  
  <p>that shouldn't matter though, because I can get the hashing and verification process working in my registration function:</p>
  
  <pre><code>$hash = password_hash($pass, PASSWORD_DEFAULT);
  
  echo $pass;
  echo $hash;
  
  if( password_verify($pass,$hash) )
      echo 'success';
  else echo 'failure';
  
  //success is always shown
  
  //EXAMPLE INPUT
  $pass = 'password';
  
  //EXAMPLE OUTPUT
  password$2y$10$JK1jumvvSIm/gP3fWE3k9O98MzvHKDRYCjRPBniYg9riACyQw7WYSsuccess
  </code></pre>
  
  <p>but whenever I try to store the hash in a MySQL database and then retrieve it for the verify function, it always fails. Here is my login function:</p>
  
  <pre><code>function user_login( $mysqli, $email, $pass ){    
  
          $err_msg = 'login: '.$mysqli-&gt;error.' | '.$email;
  
          if( $stmt = $mysqli-&gt;prepare('SELECT password FROM users WHERE email=?') ) :
  
              if( !$stmt-&gt;bind_param('s', $email) ) log_sql_error( $err_msg );
              if( !$stmt-&gt;execute() ) log_sql_error( $err_msg );
              if( !$stmt-&gt;bind_result( $hash ) ) log_sql_error( $err_msg );
              if( $stmt-&gt;fetch() === FALSE ) log_sql_error( $err_msg );
              if( !$stmt-&gt;close() ) log_sql_error( $err_msg );
  
              //I can see that these values are identical to the ones
              //echoed out in the registration function
              echo $pass;
              echo $hash;
  
              if( password_verify($pass,$hash) )
                  echo 'success';
              else echo 'failure';
  
          else : log_sql_error( $err_msg );
          endif;
  }
  //failure is always shown
  
  //EXAMPLE INPUT
  $pass = 'password';
  
  //EXAMPLE OUTPUT
  password$2y$10$JK1jumvvSIm/gP3fWE3k9O98MzvHKDRYCjRPBniYg9riACyQw7WYSfailure
  </code></pre>
  
  <p>My 'password' column has this datatype: <code>VARCHAR(255) NOT NULL</code></p>
  
  <p>No php errors show up so the only thing I can think of is that the hash value is not formatted in the same way when it comes out of the database as when it went in, but when I echo out the values, they appear to be identical.</p>
  
  <p>How else can I debug this / what is wrong with my code?</p>
  
  <p>Thanks</p>
  
  <p>UPDATE:</p>
  
  <p>This definitely has something to do with encoding:</p>
  
  <pre><code>$hardcode_hash = '$2y$10$JK1jumvvSIm/gP3fWE3k9O98MzvHKDRYCjRPBniYg9riACyQw7WYS';
  
  echo $hash;
  echo '&lt;br/&gt;';
  echo $hardcode_hash;
  echo '&lt;br/&gt;';
  
  if( $hash == $hardcode_hash )
      echo 'success';
  else echo 'failure';
  
  //OUTPUT
  $2y$10$JK1jumvvSIm/gP3fWE3k9O98MzvHKDRYCjRPBniYg9riACyQw7WYS
  $2y$10$JK1jumvvSIm/gP3fWE3k9O98MzvHKDRYCjRPBniYg9riACyQw7WYS
  failure
  </code></pre>
  
  <p>how do I reformat the SQL value to match the output of password_hash? Here's what I've tried:</p>
  
  <pre><code>(string)$hash
  utf8_encode($hash)
  </code></pre>
  
  <p>if I do:</p>
  
  <pre><code>$hash = settype($hash,"string");
  </code></pre>
  
  <p><code>if($hash == $hardcode_hash)</code> returns true, but <code>password_verify($pass, $hash)</code> still returns false</p>