Comment changer le mot de passe en utilisant password_hash?

Question

J'ai essayé de changer ce code php en mot_de_passe quand l'utilisateur entre son mot de passe s'il veut le changer, mais il ne correspondra jamais parce que le mot pssword stocké dans ma base de données est haché pendant le registre. Il entrée pour correspondre avec le mot de passe haché sur DB qui ne fonctionne pas.

Je sais que je devrais utiliser password_verify mais je ne sais pas quelle partie de ce code dois-je insérer?

<?php 
    include 'session.php'; 
    $db = new mysqli('localhost', 'root', '', 'alumni'); 
    if(isset($_POST['submit'])): 
    extract($_POST); 


    $user_check=$_SESSION['login_user']; 

    $old_pwd=$_POST['old_password']; 
    $pwd=$_POST['password']; 
    $c_pwd=$_POST['confirm_pwd']; 
    if($old_pwd!="" && $pwd!="" && $c_pwd!="") : 


    if($pwd == $c_pwd) : 
    if($pwd!=$old_pwd) : 
    $sql="SELECT * FROM `alumni` WHERE `username`='$user_check' AND `password` ='$old_pwd'"; 
    $db_check=$db->query($sql); 
    $count=mysqli_num_rows($db_check); 
    if($count==1) : 
    $fetch=$db->query("UPDATE `alumni` SET `password` = '$pwd' WHERE `username`='$user_check'"); 
    $old_pwd=''; $pwd =''; $c_pwd = ''; 
    $msg_sucess = "Password successfully updated!"; 
    else: 
    $error = "Old password is incorrect. Please try again."; 
    endif; 
    else : 
    $error = "Old password and new password are the same. Please try again."; 
    endif; 
    else: 
    $error = "New password and confirm password do not match."; 
    endif; 
    else : 
    $error = "Please fill all the fields"; 
    endif; 
    endif; 
?> 

Answer 1

Essayez cette

<?php 
    include 'session.php'; 
    session_start(); 
    $db = new mysqli('localhost', 'root', '', 'alumni'); 
    if(isset($_POST['submit'])): 
    extract($_POST); 


    $user_check=$_SESSION['login_user']; 

    $old_pwd=$_POST['old_password']; 
    $pwd=$_POST['password']; 
    $c_pwd=$_POST['confirm_pwd']; 
    if($old_pwd!="" && $pwd!="" && $c_pwd!="") : 


    if($pwd == $c_pwd) : 
    if($pwd!=$old_pwd) : 
    $sql="SELECT * FROM `alumni` WHERE `username`='$user_check' AND `password` =PASSWORD($old_pwd)"; 
    $db_check=$db->query($sql); 
    $count=mysqli_num_rows($db_check); 
    if($count==1) : 
    $fetch=$db->query("UPDATE `alumni` SET `password` = PASSWORD($pwd) WHERE `username`='$user_check'"); 
    $old_pwd=''; $pwd =''; $c_pwd = ''; 
    $msg_sucess = "Password successfully updated!"; 
    else: 
    $error = "Old password is incorrect. Please try again."; 
    endif; 
    else : 
    $error = "Old password and new password are the same. Please try again."; 
    endif; 
    else: 
    $error = "New password and confirm password do not match."; 
    endif; 
    else : 
    $error = "Please fill all the fields"; 
    endif; 
    endif; 
?> 

Answer 2

je l'ai enfin travailler! Merci beaucoup d'avoir aidé, surtout à Sir Sean! : D

Je changé ceci:

$sql="SELECT * FROM `alumni` WHERE `username`='$user_check' AND `password` ='$old_pwd'"; 
$db_check=$db->query($sql); 
$count=mysqli_num_rows($db_check); 

if($count==1) : 
    $fetch=$db->query("UPDATE `alumni` SET `password` = '$pwd' WHERE `username`='$user_check'"); 

à ceci:

$sql=("SELECT * FROM alumni WHERE username='$user_check'"); 
$db_check=$db->query($sql); 
if(password_verify($old_pwd,$db_check->fetch_assoc()['password'])): 
$fetch=$db->query("UPDATE `alumni` SET `password` = '$new_pw' WHERE username`='$user_check'"); 

Et oui, j'ai ajouté une nouvelle variable $ new_pw

$new_pw = password_hash($c_pwd, PASSWORD_DEFAULT); 

Si vous pensez les gars je l'ai fait dans un mauvais sens, s'il vous plaît n'hésitez pas à commenter. Merci :)