pset7 compare passwords: entered one and in users table, how to unhash

Question

I am doing pset7 reset password part. I need the user to enter the old password and then I have to compare that one with the one in the users table. But that one is a hashed one. Although I assume a function password_hash($_POST["password"],PASSWORD_DEFAULT) should generate different hashes even for the same password (honestly, I didn't check the code of password_hash($_POST["password"],PASSWORD_DEFAULT) function), I have anyway tried to:

//hash users old password
$old_pass = password_hash($_POST["old_password"],PASSWORD_DEFAULT);

$row = CS50::query("SELECT hash FROM users WHERE username = ?", $_SESSION["id"]); 
$old_hash = $row[0]["hash"];

if($old_pass != $old_hash )
{
   apologize("Please, make sure you have entered a correct password.");
}

and this doesn't work. Obviously, the password_hash() function does produce different hashes for the same input. I will be grateful for your help on how to check if the old password is a correct one, i.e. corresponds to the one created upon registration. Or shall I somehow create links between register.php and this new file? Thank you very much!

Answer 1

From the PHP password_hash() documentation

salt - to manually provide a salt to use when hashing the password. Note that this will override and prevent a salt from being automatically generated.

If omitted, a random salt will be generated by password_hash() for each password hashed. This is the intended mode of operation.

Warning The salt option has been deprecated as of PHP 7.0.0. It is now preferred to simply use the salt that is generated by default.

Bellow that:

Returns the hashed password, or FALSE on failure. The used algorithm, cost and salt are returned as part of the hash. Therefore, all information that's needed to verify the hash is included in it. This allows the password_verify() function to verify the hash without needing separate storage for the salt or algorithm information.

An example:

<?php
    $hash = password_hash("password", PASSWORD_DEFAULT);
    print($hash."\n");
    if (password_verify("password", $hash))
    {
        print('The password was "password"'."\n");
    }
    else
    {
        print('This will never print'."\n");
    }
?>

So yes, password_hash() will generate a different output every time for the same input, because it "salts" the input every time with a randomly generated salt. Use password_verify() instead.

Answer 2

First of all, you're storing the old password hash in $old_password but later checking against the value of $old_pass. This obviously won't do what you want.

Second, PHP uses different functions to hash passwords and to validate passwords. Take a careful look at the distribution code provided for login.php.

Finally, the whole point of a hash function is that it should always produce the same output for any given input. That means you should never need to "unhash" anything!

EDIT: If you consider the question answered, please accept the answer. Otherwise, the forum will keep showing it in the list of Unanswered Questions!