Password hashed Login

[Davide Cat]

Ciao ragazzi,
non riesco a far funzionare il login utilizzando il salvataggio della password con hash.
Il codice di registrazione dell'utente è il seguente dove cifro la password con un salt e vado a salvarla sul db:

if (isset($_REQUEST['username'])){        
...tutti i parametri...      
$password = stripslashes($_REQUEST['password']);        
$password = mysqli_real_escape_string($con,$password);
$options=[            
'cost'=>10,             
'salt'=>'gcw7fZyAiWUTNEhGvt6Vqr'        ]; //opzioni della cifratura        
$crypt_password = password_hash($password, PASSWORD_BCRYPT, $options);    //cifratura
        $trn_date = date("Y-m-d H:i:s");        $activated = 0;
        $token = bin2hex(openssl_random_pseudo_bytes(16));        $url = 'http://localhost:8888/form-1/verify.php';
        $_SESSION['token'] = $token;        // Register user on database        
        $check_user = mysqli_query($con, "SELECT username FROM users where username = '$username' or email = '$email'");
        if(mysqli_num_rows($check_user) > 0){            
              echo("<h1>Username or email already exist!</h1>");        
        }else{            
              $query = "INSERT into `users` (username, name, lastname, birthdate, password_hash, email, token, activated, trn_date)             VALUES ('$username', '$name', '$lastname', '$birthdate',                     '$crypt_password', '$email', '$token', $activated, '$trn_date')";            
              $result = mysqli_query($con,$query); 

In fase di login invece eseguo le seguenti operazioni ma non funziona:

if (isset($_POST['username'])){                                                                                
...tutti i parametri..                        
$password = stripslashes($_REQUEST['password']);                                        
$password = mysqli_real_escape_string($con,$password);

                                         
//Checking is user existing in the database or not                                        
$query = "SELECT * FROM `users` WHERE username='$username' and birthdate='$birthdate' and activated='1' and password='$password'";                                        
$crypt_password = "SELECT `password` FROM `users` WHERE username='$username'";
if (password_verify($password, $crypt_password)) {                                            
echo "Success!";                                        
}else{                                            
echo "Invalid!";                                        
}                                        
$result = mysqli_query($con,$query) or die(mysql_error());                                        
$rows = mysqli_num_rows($result);                                        
if($rows==1){                                            
$_SESSION['username'] = $username;                                            
$_SESSION['tentativi_login']=0;                                            
header("Location: home.php"); 

Sapete aiutarmi?

Grazie mille!

[boots]

Mi sa che hai fatto un po' di casino con il login. Dovresti fare una cosa del genere:

if (isset($_POST['username'])){                                                                                
   ...tutti i parametri..                        
   $password = stripslashes($_POST['password']);                                        
   $password = mysqli_real_escape_string($con,$password);
   $result = mysqli_query($con, "SELECT * FROM users WHERE username='$username' ");
   $user = mysqli_fetch_assoc($con,$result);
   if(!$user){
        // Utente non trovato;
   }
   if(password_verify($password, $user['password_hash'])){
       // login ok
   }else{
       //  login errato
   }

} 

[Davide Cat]

Una cosa del genere?

$password = stripslashes($_REQUEST['password']);                                        
$password = mysqli_real_escape_string($con,$password);
//Checking is user existing in the database or not                                        
$query = "SELECT * FROM `users` WHERE username='$username' and birthdate='$birthdate' and activated='1'";                                        
$result = mysqli_query($con,$query) or die(mysql_error());                                        
$user = mysqli_fetch_assoc($result);                                        
if(password_verify($password, $user['crypt_password'])){                                      
$_SESSION['username'] = $username;                                            
$_SESSION['tentativi_login']=0;                                            
header("Location: home.php"); // Redirect user to homepage                                            
}else{                                                
$_SESSION['username'] = $username;                                                
echo $_SESSION['username'];                                                
$_SESSION['tentativi_login']= $_SESSION['tentativi_login']+1;
if ($_SESSION['tentativi_login'] <= 2) {                                                    
echo "<div class='form'><h3>Username/password is incorrect or account is not active.</h3><br/>Click here to <a href='login.php'>Login</a> to try again otherwise check your email.</div>";     
}else{                                                        
echo '
<form role="form" name ="registration" action="login.php" method="post" class="login-form">           

<div class="g-recaptcha" data-sitekey="6LelkCAUAAAAAGuitSFVJrwUAigkUpxfCqV1j5jt"></div>           

<button type="submit" class="btn" name="Signup" value="register">Retry</button>                         </form>                                                        
';                                                    
$_SESSION['tentativi_login']=0;                                                
}                                            
}         
}else{