|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2020-10-29 18:50 UTC] brennen at swedecreek dot com
Description:
------------
When using double quotes around $hash in password_verify, it always returns false. You have to use double quotes.
Test script:
---------------
if(password_verify("helloworld", "$2y$10$nqqnTXGG/W4kNWDQ6Zlx8uNbduUfYmn/iS7eKOj9fbG6iVa.3dOAi")) {
echo "Success";
}
else {
echo "Fail";
}
Expected result:
----------------
Success
Actual result:
--------------
Fail
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Nov 06 02:00:01 2025 UTC |
because you lack basics and proper error-reporting in double quotes you need to secape $ as \$ ---------------- Interactive shell php > if(password_verify("helloworld", "$2y$10$nqqnTXGG/W4kNWDQ6Zlx8uNbduUfYmn/iS7eKOj9fbG6iVa.3dOAi")) {echo "Success";} else {echo "Fail";} Notice: Undefined variable: nqqnTXGG in php shell code on line 1 Failphp > if(password_verify("helloworld", "\$2y\$10\$nqqnTXGG/W4kNWDQ6Zlx8uNbduUfYmn/iS7eKOj9fbG6iVa.3dOAi")) {echo "Success";} else {echo "Fail";} Success php >Just for clarification: The only thing that needs to be escaped is the 3rd "$" as the first two are not starting a variable as the $ is immediately followed by a number which is not allowed as the first character of a variable name. So if you have to use double quotes you need to at least write it like this: if(password_verify("helloworld", "$2y$10\$nqqnTXGG/W4kNWDQ6Zlx8uNbduUfYmn/iS7eKOj9fbG6iVa.3dOAi")) { echo "Success"; } else { echo "Fail"; } But for the sake of explicitness (and my own sanity) I would always use single quotes unless I explicitly want variable replacement to actually happen within the string.