Password hashing in a database

Okay

here is the entire content of my userManager.class.php page:

<?php use LDAP\Result; require_once 'Model.class.php'; require_once 'User.class.php'; class UserManager extends Model { private $user; // Array of users public function ajoutUser($user) { $this->users[] = $user; } public function getUser() { return $this->users; } // Function that loads all users from the database. public function chargementUsers() { $req = $this->getBdd()->prepare( 'SELECT id, login,password, mail, admin, bl, dist, NomPrenom, demandevalidation , pilote, rs FROM user' ); $req->execute(); $donnees = $req->fetchAll(PDO::FETCH_ASSOC); $req->closeCursor(); // Error code: #UM01 if (!empty($donnees)) { foreach ($donnees as $donnees_users) { $q = new User( $donnees_users['id'], $donnees_users['login'], $donnees_users['password'], $donnees_users['mail'], $donnees_users['admin'], $donnees_users['bl'], $donnees_users['dist'], $donnees_users['NomPrenom'], $donnees_users['demandevalidation'], $donnees_users['pilote'], $donnees_users['rs'] ); $this->ajoutUser($q); } } else { Toolbox::ajouterMessageAlerte("Failed to load users - Error code: #UM01", Toolbox::COULEUR_ROUGE); header('Location: ' . URL); } } // Function for getting a user by their ID public function getUserById($id) { for ($i = 0; $i < count($this->users); $i++) { if ($this->users[$i]->getId() === $id) { return $this->users[$i]; } } } // Function to get a user's password based on their login private function getPasswordUser($login) { $req = "SELECT password FROM user WHERE login = :login"; $stmt = $this->getBdd()->prepare($req); $stmt->bindValue(":login", $login, PDO::PARAM_STR); $stmt->execute(); $resultat = $stmt->fetch(PDO::FETCH_ASSOC); $stmt->closeCursor(); // Error code: #UM03 if ($resultat != false) { return $resultat['password']; } else { // uncomment this line in production and comment the line below Toolbox::ajouterMessageAlerte("Request failure", Toolbox::COULEUR_ROUGE); Toolbox::ajouterMessageAlerte("Request failure - Error code: #UM03", Toolbox::COULEUR_ROUGE); header("location: " . URL); } } // Function that compares the database password and the one entered by the user public function isCombinaisonValide($login, $password) { //$password = hash('sha256',$password); //$password = sha1($password); $passwordBD = $this->getPasswordUser($login); // Error code: #UM04 if (password_verify($password, $passwordBD)) { return true; } else { // uncomment this line in production and comment the line below Toolbox::ajouterMessageAlerte("Connection failed", Toolbox::COULEUR_ROUGE); Toolbox::ajouterMessageAlerte("Comparison failed - Error code: #UM04", Toolbox::COULEUR_ROUGE); return false; } } // Function that adds a user to the database public function ajoutUserBd( $login, $password, $mail, $admin, $bl, $dist, $NomPrenom, $demandevalidation, $pilote, $rs ) { $login = strip_tags($login); $password = strip_tags($password); $mail = strip_tags($mail); $admin = strip_tags($admin); $bl = strip_tags($bl); $dist = strip_tags($dist); $NomPrenom = strip_tags($NomPrenom); $demandevalidation = strip_tags($demandevalidation); $pilote = strip_tags($pilote); $rs = strip_tags($rs); $hashed_password = password_hash($password, PASSWORD_DEFAULT); //$password = hash('sha256',$password); //$password = sha1($password); $req = "INSERT INTO user(login, password, mail, admin, bl, dist, NomPrenom, demandevalidation, pilote, rs) VALUES(:login, :password, :mail, :admin, :bl, :dist, :NomPrenom, :demandevalidation, :pilote, :rs)"; $stmt = $this->getBdd()->prepare($req); $stmt->bindValue(":login", $login, PDO::PARAM_STR); $stmt->bindValue(":password", $hashed_password, PDO::PARAM_STR); $stmt->bindValue(":mail", $mail, PDO::PARAM_STR); $stmt->bindValue(":admin", $admin); $stmt->bindValue(":bl", $bl); $stmt->bindValue(":dist", $dist, PDO::PARAM_STR); $stmt->bindValue(":NomPrenom", $NomPrenom, PDO::PARAM_STR); $stmt->bindValue(":demandevalidation", $demandevalidation, PDO::PARAM_STR); $stmt->bindValue(":pilote", $pilote, PDO::PARAM_STR); $stmt->bindValue(":rs", $rs, PDO::PARAM_STR); $resultat = $stmt->execute(); $stmt->closeCursor(); // Error code: #UM05 if ($resultat > 0) { $user = new User( $this->getBdd()->lastInsertId(), $login, $password, $mail, $admin, $bl, $dist, $NomPrenom, $demandevalidation, $pilote, $rs ); $this->ajoutUser($user); Toolbox::ajouterMessageAlerte("User addition successful", Toolbox::COULEUR_VERTE); } else { Toolbox::ajouterMessageAlerte("User addition failed - Error code: #UM05", Toolbox::COULEUR_ROUGE); header('Location: ' . URL . "users"); } } // Function for modifying a user public function modificationUserBd( $id, $login, $mail, $admin, $bl, $dist, $NomPrenom, $demandevalidation, $pilote, $rs ) { $login = strip_tags($login); $mail = strip_tags($mail); $admin = strip_tags($admin); $bl = strip_tags($bl); $dist = strip_tags($dist); $NomPrenom = strip_tags($NomPrenom); $demandevalidation = strip_tags($demandevalidation); $pilote = strip_tags($pilote); $rs = strip_tags($rs); $req = "UPDATE user set login = :login, mail = :mail, admin = :admin, bl = :bl, dist = :dist, NomPrenom = :NomPrenom, demandevalidation = :demandevalidation, pilote = :pilote, rs = :rs WHERE id = :id"; $stmt = $this->getBdd()->prepare($req); $stmt->bindValue(":id", $id, PDO::PARAM_INT); $stmt->bindValue(":login", $login, PDO::PARAM_STR); $stmt->bindValue(":mail", $mail, PDO::PARAM_STR); $stmt->bindValue(":admin", $admin, PDO::PARAM_STR); $stmt->bindValue(":bl", $bl); $stmt->bindValue(":dist", $dist); $stmt->bindValue(":NomPrenom", $NomPrenom, PDO::PARAM_STR); $stmt->bindValue(":demandevalidation", $demandevalidation); $stmt->bindValue(":pilote", $pilote); $stmt->bindValue(":rs", $rs); $resultat = $stmt->execute(); $stmt->closeCursor(); if ($resultat > 0) { $this->getUserById($id)->setLogin($login); $this->getUserById($id)->setMail($mail); $this->getUserById($id)->setAdmin($admin); $this->getUserById($id)->setBl($bl); $this->getUserById($id)->setDist($dist); $this->getUserById($id)->setNomPrenom($NomPrenom); $this->getUserById($id)->setDemandeValidation($demandevalidation); $this->getUserById($id)->setPilote($pilote); $this->getUserById($id)->setRs($rs); } } public function getUserInformation($login) { $req = "SELECT * FROM user WHERE login = :login"; $stmt = $this->getBdd()->prepare($req); $stmt->bindValue(":login", $login, PDO::PARAM_STR); $stmt->execute(); $resultat = $stmt->fetch(PDO::FETCH_ASSOC); $stmt->closeCursor(); return $resultat; } public function deleteUserBd($id) { $req = " Delete from `user` where `id` = " . $id . " "; $stmt = $this->getBdd()->prepare($req); $stmt->bindValue(":id", $id, PDO::PARAM_INT); $stmt->execute(); $stmt->closeCursor(); Toolbox::ajouterMessageAlerte("Deletion has been completed", Toolbox::COULEUR_VERTE); } //Function for resetting password public function motDePasseReinitValid($login, $mail) { $req = "SELECT id, mail, password FROM user WHERE login = :login AND mail = :mail"; $stmt = $this->getBdd()->prepare($req); $stmt->bindValue(":login", $login, PDO::PARAM_STR); $stmt->bindValue(":mail", $mail , PDO::PARAM_STR); $stmt->execute(); $resultat = $stmt->fetch(PDO::FETCH_ASSOC); $stmt->closeCursor(); if ($resultat == false) { Toolbox::ajouterMessageAlerte("Invalid Login / Mail combination", Toolbox::COULEUR_ROUGE); //header('Location: ' . URL . "users/motdepasse"); var_dump($resultat); } else { $char = '1234567890abcdefghijklmnopqrstuvwxyz0123456789'; $key = str_shuffle($char); $longueur = '8'; //Does not work if set to 12 $possible = '123456789abcdfghjkmnpqrtvwxyzABCDFGHJKLMNPQRTVWXYZ'; $mdp = ''; // this value will be used later $longueurMax = strlen($possible); if ($longueur > $longueurMax) { $longueur = $longueurMax; } $i = 0; while ($i < $longueur) { // pick a random character $caractere = substr($possible, mt_rand(0, $longueurMax - 1), 1); $mdp .= $caractere; $i++; } $req = "INSERT INTO reinit_passwd(id_user, key_gen, new_password) VALUES(:id_user, :key_gen, :new_password)"; $stmt = $this->getBdd()->prepare($req); $stmt->bindValue(":id_user", $resultat['id'], PDO::PARAM_STR); $stmt->bindValue(":key_gen", $key, PDO::PARAM_STR); $stmt->bindValue(":new_password", $mdp, PDO::PARAM_STR); $stmt->execute(); $stmt->closeCursor(); var_dump($resultat); //=====Declaration of messages in text and HTML format. $passage_ligne = "\r\n"; $message_txt = "Hello, you have requested a new password for the Portal."; $message_html = "<html><head></head><body>Hello,<br /><br /> You have requested a new password for <b>the Portal</b>.<br /><br />To confirm the password reset, please click on the link below : <br /><br /><a href=\"http://dns.fr/portail/users/motdepassereinitvalid/" . $key . "\">http://dns.fr/portail/users/motdepassereinitvalid/" . $key . "<a/></body></html>"; //========== //=====Creation of the boundary. $boundary = "-----=" . md5(rand()); $boundary_alt = "-----=" . md5(rand()); //========== //=====Defining the subject. $sujet = "Portal - Forgotten password". chr(233); //========= //=====Creating the email header. $header = "From: \"Portal\"<mail.xxx.com>" . $passage_ligne; $header .= "Reply-to: \"Portal \" <mail.xxx.com>" . $passage_ligne; $header .= "MIME-Version: 1.0" . $passage_ligne; $header .= "Content-Type: multipart/mixed;" . $passage_ligne . " boundary=\"$boundary\"" . $passage_ligne; //========== //=====Creating the message. $message = $passage_ligne . "--" . $boundary . $passage_ligne; $message .= "Content-Type: multipart/alternative;" . $passage_ligne . " boundary=\"$boundary_alt\"" . $passage_ligne; $message .= $passage_ligne . "--" . $boundary_alt . $passage_ligne; //=====Adding the message in text format. $message .= "Content-Type: text/plain; charset=\"ISO-8859-1\"" . $passage_ligne; $message .= "Content-Transfer-Encoding: 8bit" . $passage_ligne; $message .= $passage_ligne . $message_txt . $passage_ligne; //========== $message .= $passage_ligne . "--" . $boundary_alt . $passage_ligne; //=====Adding the message in HTML format. $message .= "Content-Type: text/html; charset=\"ISO-8859-1\"" . $passage_ligne; $message .= "Content-Transfer-Encoding: 8bit" . $passage_ligne; $message .= $passage_ligne . $message_html . $passage_ligne; //========== //=====We close the alternative boundary. $message .= $passage_ligne . "--" . $boundary_alt . "--" . $passage_ligne; $message .= $passage_ligne . "--" . $boundary . $passage_ligne; //========== if (mail($mail, $sujet, $message, $header)) { Toolbox::ajouterMessageAlerte("An email for resetting the password has been sent to you", Toolbox::COULEUR_VERTE); //header('Location: ' . URL); } else { Toolbox::ajouterMessageAlerte("Failed to send the email. Please try again. If the problem persists, contact the IT department", Toolbox::COULEUR_ROUGE); } } } //Function to validate the password reset public function motDePasseReinitValidation($key) { $req = "SELECT id, id_user, new_password FROM reinit_passwd WHERE key_gen = '$key'"; $stmt = $this->getBdd()->prepare($req); $stmt->execute(); $resultat = $stmt->fetch(PDO::FETCH_ASSOC); $stmt->closeCursor(); if ($resultat > 0) { $idtempo = $resultat['id_user']; $motdepassetemp = $resultat['new_password']; $motdepassehash = password_hash($motdepassetemp, PASSWORD_DEFAULT); //$motdepassehash = hash('sha256',$motdepassetemp); //$motdepassehash = sha1($motdepassetemp); echo "<br> Password from the database: " . $motdepassetemp; echo "<br> Hashed password: " . $motdepassehash; // is the password hashed correctly? exit; /* apparently.. this code is useless here.. might as well move it where it is needed! $req = "SELECT mail FROM user WHERE id = $idtempo"; $stmt = $this->getBdd()->prepare($req); $stmt->execute(); $resultatmail = $stmt->fetch(PDO::FETCH_ASSOC); $stmt->closeCursor(); $mailtest = $resultatmail['mail']; */ try{ $req = "UPDATE user SET password = :password WHERE id = :id"; $stmt = $this->getBdd()->prepare($req); $stmt->bindValue(":id", $idtempo, PDO::PARAM_INT); $stmt->bindValue(":password", $motdepassehash, PDO::PARAM_STR); $resultat = $stmt->execute(); $stmt->closeCursor(); var_dump($resultat); // should display true or false .. true if updated! }catch(Exception $e){ echo "Error: " . $e->getMessage(); exit; } // $req = "SELECT mail FROM user WHERE id = $idtempo"; // $stmt = $this->getBdd()->prepare($req); // $stmt->execute(); // $resultatmail = $stmt->fetch(PDO::FETCH_ASSOC); // $stmt->closeCursor(); // $mailtest = $resultatmail['mail']; // $req = "UPDATE user // SET password = :password // WHERE id = :id"; // $stmt = $this->getBdd()->prepare($req); // $stmt->bindValue(":id", $idtempo, PDO::PARAM_INT); // $stmt->bindValue(":password", $motdepassehash, PDO::PARAM_STR); // $resultat = $stmt->execute(); // $stmt->closeCursor(); // var_dump($motdepassehash); $req = " DELETE FROM reinit_passwd WHERE id_user = $idtempo "; $stmt = $this->getBdd()->prepare($req); $stmt->bindValue(":id_user", $idtempo, PDO::PARAM_INT); $resultatdelete = $stmt->execute(); $stmt->closeCursor(); //=====Declaration of messages in text and HTML format. $passage_ligne = "\r\n"; $message_txt = "Hello, you have reset your password for the Portal."; $message_html = "<html><head></head><body>Hello,<br /><br /> You have reset your password.<br /><br /> New password: " . $motdepassetemp . "<a/></body></html>"; //========== //=====Creation of the boundary. $boundary = "-----=" . md5(rand()); $boundary_alt = "-----=" . md5(rand()); //========== //=====Defining the subject. $sujet = "Portal - New password"; //========= //=====Creating the email header. $header = "From: \"Portal\"<mail.xxx.com>" . $passage_ligne; $header .= "Reply-to: \"Portal\"<mail.xxx.com>" . $passage_ligne; $header .= "MIME-Version: 1.0" . $passage_ligne; $header .= "Content-Type: multipart/mixed;" . $passage_ligne . " boundary=\"$boundary\"" . $passage_ligne; //========== //=====Creating the message. $message = $passage_ligne . "--" . $boundary . $passage_ligne; $message .= "Content-Type: multipart/alternative;" . $passage_ligne . " boundary=\"$boundary_alt\"" . $passage_ligne; $message .= $passage_ligne . "--" . $boundary_alt . $passage_ligne; //=====Adding the message in text format. $message .= "Content-Type: text/plain; charset=\"ISO-8859-1\"" . $passage_ligne; $message .= "Content-Transfer-Encoding: 8bit" . $passage_ligne; $message .= $passage_ligne . $message_txt . $passage_ligne; //========== $message .= $passage_ligne . "--" . $boundary_alt . $passage_ligne; //=====Adding the message in HTML format. $message .= "Content-Type: text/html; charset=\"ISO-8859-1\"" . $passage_ligne; $message .= "Content-Transfer-Encoding: 8bit" . $passage_ligne; $message .= $passage_ligne . $message_html . $passage_ligne; //========== //=====We close the alternative boundary. $message .= $passage_ligne . "--" . $boundary_alt . "--" . $passage_ligne; $message .= $passage_ligne . "--" . $boundary . $passage_ligne; //========== //=====Sending the email. if (mail($mailtest, $sujet, $message, $header) && ($resultatdelete != false) && ($resultat != false) && ($resultatmail != false)) { Toolbox::ajouterMessageAlerte("Your password has been successfully reset", Toolbox::COULEUR_VERTE); //header('Location: ' . URL); } else { Toolbox::ajouterMessageAlerte("Failed to reset the password - Error code: #UM01", Toolbox::COULEUR_ROUGE); //header('Location: ' . URL . "users/motdepasse"); } } else { Toolbox::ajouterMessageAlerte("The link has not been approved by our site. Please try again. Error code: #UM02", Toolbox::COULEUR_ROUGE); //header('Location: ' . URL . "users/motdepasse"); } } } 

My userController.php page:

 <?php require_once "models/UserManager.class.php"; class UserController { public $userManager; public function __construct() { $this->userManager = new UserManager; $this->userManager->chargementUsers(); } public function afficherUsers() { $users = $this->userManager->getUser(); require "views/user/users.view.php"; } public function modificationUser($id) { $user = $this->userManager->getUserById($id); require "views/user/updateUser.view.php"; } public function ajoutUser() { require "views/user/createUser.view.php"; } public function motDePasseOublie() { require "views/motDePasseOublie.view.php"; } public function ajoutuserValidation() { if ($_POST['bl'] != 'on') { $_POST['bl'] = 0; } else { $_POST['bl'] = 1; } if ($_POST['dist'] != 'on') { $_POST['dist'] = 0; } else { $_POST['dist'] = 1; } if ($_POST['admin'] != 'on') { $_POST['admin'] = 0; } else { $_POST['admin'] = 1; } if ($_POST['demandevalidation'] != 'on') { $_POST['demandevalidation'] = 0; } else { $_POST['demandevalidation'] = 1; } if ($_POST['pilote'] != 'on') { $_POST['pilote'] = 0; } else { $_POST['pilote']