I am doing pset7 reset password part. I need the user to enter the old password and then I have to compare that one with the one in the users table. But that one is a hashed one. Although I assume a function password_hash($_POST["password"],PASSWORD_DEFAULT)
should generate different hashes even for the same password (honestly, I didn't check the code of password_hash($_POST["password"],PASSWORD_DEFAULT) function), I have anyway tried to:
//hash users old password
$old_pass = password_hash($_POST["old_password"],PASSWORD_DEFAULT);
$row = CS50::query("SELECT hash FROM users WHERE username = ?", $_SESSION["id"]);
$old_hash = $row[0]["hash"];
if($old_pass != $old_hash )
{
apologize("Please, make sure you have entered a correct password.");
}
and this doesn't work. Obviously, the password_hash() function does produce different hashes for the same input. I will be grateful for your help on how to check if the old password is a correct one, i.e. corresponds to the one created upon registration. Or shall I somehow create links between register.php and this new file? Thank you very much!