Avoir BCrypt avec PHP et MYSQLi. J'essaie de me connecter mais ça ne fonctionne pas

Question

Voici le code. Je pense que le problème est uniquement dans bcrypt. ou quelque chose s'il vous plaît aidez-moi à le découvrir.

md5 est mort de nos jours. Donc désolé Im nood de ce bcrypt.

<?php 
if (isset($_POST['btnLogin'])) 
{ 

    $username = $_POST['username']; 
    $password2 = password_hash($_POST['password'],PASSWORD_BCRYPT); 
     $username = stripslashes($username); 
     $username = mysqli_real_escape_string($conn,$username); 

     $result=$conn->query("SELECT * FROM admin WHERE USERNAME = '$username'") or die(mysql_error()); 

     if(!$result){ 
      echo "<script>alert('Incorrect User.');</script>"; 
      } 
     else if(!$conn) 
     { 
      die("Could not connect to database.".mysql_error()); 
     } 
     else 
     { 
      while($row = mysqli_fetch_array($result)) 
      { 
       @$ID = $row['ID']; 
       @$FULLNAME = $row['FULLNAME']; 
       @$USERNAME = $row['USERNAME']; 
     @$PICTURE = $row['PICTURE']; 
       @$PASSWORD = $row['PASSWORD']; 
       @$USER_TYPE = $row['USER_TYPE']; 
       @$ACCESS_TYPE = $row['ACCESS_TYPE']; 
      } 
      } 
     if (@$ACCESS_TYPE == '1' && password_verify($PASSWORD, $password2)) 
     { 
     $_SESSION['ID'] = $ID; 
     $_SESSION['FULLNAME'] = $FULLNAME; 
     $_SESSION['USERNAME'] = $USERNAME; 
     $_SESSION['PICTURE'] = $PICTURE; 
     $_SESSION['PASSWORD'] = $PASSWORD; 
     $_SESSION['USER_TYPE'] = $USER_TYPE; 
     $_SESSION['ACCESS_TYPE'] = $ACCESS_TYPE; 

     echo "<script>window.location.href = 'user_log_in.php' </script>";  
     } 
     elseif (@$ACCESS_TYPE == '2' && password_verify($PASSWORD, $password2)) 
     { 
     $_SESSION['ID'] = $ID; 
     $_SESSION['FULLNAME'] = $FULLNAME; 
     $_SESSION['USERNAME'] = $USERNAME; 
     $_SESSION['PICTURE'] = $PICTURE; 
     $_SESSION['PASSWORD'] = $PASSWORD; 
     $_SESSION['USER_TYPE'] = $USER_TYPE; 
     $_SESSION['ACCESS_TYPE'] = $ACCESS_TYPE; 

     echo "<script>window.location.href = 'user_log_in_mod.php'</script>";  
     } 
     else{ 
     echo "<script>alert('Incorrect Password!'); 
       </script>";  
     } 

} 
?> 

Answer 1

Supprimer @ de votre code. Personnellement, je regarderais comment vous capitaliser vos variables/sql, il est généralement accepté que vous utilisez camelCase ou underscores.

De plus, à moins que je ne me trompe, vous ne lancez pas l'appel à la base de données, mais seulement la requête. Au lieu de:

$result=$conn->query("SELECT * FROM admin WHERE USERNAME = '$username'") or die(mysql_error()); 

j'écrirais (hors évasion que j'écris normalement ma propre fonction pour cela):

$query = "SELECT * FROM admin WHERE USERNAME = '{$username}' "; 
$get_users_query = mysqli_query($connection, $query); 
while($row = mysqli_fetch_assoc($get_users_query)){ 
    $ID = $row['ID']; 
    $FULLNAME = $row['FULLNAME']; 
    $USERNAME = $row['USERNAME']; 
    $PICTURE = $row['PICTURE']; 
    $PASSWORD = $row['PASSWORD']; 
    $USER_TYPE = $row['USER_TYPE']; 
    $ACCESS_TYPE = $row['ACCESS_TYPE']; 

    //found_password == matched password in database. 
    if(password_verify($password2, $PASSWORD)){ 
    //Do your stuff. 
     } 
    }