mariofont / PHP-Login

Simple, easy-to-use, and database-free login system.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Usage of double quotes for $Password in config.php results in log in failure

danvanbueren opened this issue · comments

commented

[ISSUE] Unable to log in after updating credentials with new hash.

See: config.php, line 5
$Password = "$2y$10$1GmNO63bbKWpaPxcqLaLW.yVmvoxyOD9krWXxn2XAY.QSdbfcARDK";

Been scratching my head over this for the past few days, but finally figured it out when I printed what was actually stored in $Password. Turns out anytime the parser found a character set preceded by a $ with the following character eligible to be parsed, it would truncate everything from that point and on.

i.e.
$Password = "$2y$10$mnfqkejCWkQCGtaouWeUxuKdzHviRA2M1CZWuenSBRYW1aeNhpYpm" => $2y$10

  1. Single quoted strings will display things almost completely "as is." Variables and most escape sequences will not be interpreted. The exception is that to display a literal single quote, you can escape it with a back slash ', and to display a back slash, you can escape it with another backslash \ (So yes, even single quoted strings are parsed).
  2. Double quote strings will display a host of escaped characters (including some regexes), and variables in the strings will be evaluated. An important point here is that you can use curly braces to isolate the name of the variable you want evaluated. For example let's say you have the variable $type and you want to echo "The $types are". That will look for the variable $types. To get around this use echo "The {$type}s are" You can put the left brace before or after the dollar sign. Take a look at string parsing to see how to use array variables and such.
    Reference: https://stackoverflow.com/a/3446286

So, my reaction to this information is this:
$Password = '$2y$10$mnfqkejCWkQCGtaouWeUxuKdzHviRA2M1CZWuenSBRYW1aeNhpYpm'

[TL;DR] Correctly store the hash by changing double quotes to single quotes.

How can i change the password?

commented

Use the PHP method password_hash() - see https://www.php.net/manual/en/function.password-hash.php.

Example:
$var = 'my-password'; $hash = password_hash($var, PASSWORD_DEFAULT);

Hey there! Thanks @danvanbueren for the info and sorry it took so long to fix. Should be working now 👍