php - Password verify bcrypt, can't seem to match database -

this question has answer here:

• how use bcrypt hashing passwords in php? 9 answers
• php & mysql: using bcrypt hash , verifying password database 2 answers

i'm trying make password_verify match crypt password in database, i'm having problem, seems doesn't match.

i search , i've found need use varchar maximum length of 255 , still doesn't work.

here code:

if( isset($_post['bg9n']) && "bg9naw4") {    $email = $_post['email'];   $pass= $_post['pass']; if($pass) {         $crypt = password_hash($pass,password_bcrypt);         $decrypt = password_verify($pass,$crypt);     }     if(password_verify($pass,$crypt)) {         echo "sucess"; // echo sucess      } if (!empty($email) && !empty($pass) && filter_var($email,filter_validate_email) && password_verify($pass,$crypt)) {      $sql = "select email, pass clientes email ='$email' , pass = '$decrypt' ";     $query = $db_con->prepare($sql);     $query->execute();     $count = $query->rowcount();         if($count  == 1){                 $_session['email'] = $email;                 $_session['pass'] = $decrypt;                 header("location: home.php");         }          else {              echo "<br>error";          }      } 

probably easy fix can't seem find what's wrong.

thanks in advance.

it's normal behaviour. hash bcrypt not deterministic, differs launch launch, can't query it.

you have check if matches not via mysql via php.

so, first database, $isverified = password_verify($pass, $hashfromdb);

wiki