title: Phpass - how to check login username and password against username and password hash in database
body: <p>I have successfully used Phpass to hash registered users passwords and store them in a database, now i am stuck on the login how to check the sumbitted username and password, checking the username exists in the database then checking the hashed password against the one given.</p>
  
  <p>Any help much appreciated!!! Thankyou!</p>
  
  <p>This is my code:</p>
  
  <pre><code>&lt;?php
  
  // Inialize session
  session_start();
  
  // Include database connection settings
  include('config.inc');
  
  require("PasswordHash.php");
  $hasher = new PasswordHash(8, false);
  
  $username = $_POST['username'];
  $password = $_POST['password'];
  
  // Passwords should never be longer than 72 characters to prevent DoS attacks
  if (strlen($password) &gt; 72) { die("Password must be 72 characters or less"); }
  
  $query = "SELECT * FROM user WHERE username = '$username'";
  
  $query = mysql_query($query);
  $numrows = mysql_num_rows($query);
  
  if ($numrows = 1) {
  
  
  $res = mysql_query("SELECT password FROM user WHERE username = '$username'"); 
  $row = mysql_fetch_array($res); 
  $hash = $row['password']; 
  $password = $_POST['password'];
  
  if ($hasher-&gt;CheckPassword($password, $hash)) { //$hash is the hash retrieved from the      DB 
          $what = 'Authentication succeeded';
      } else {
          $what = 'Authentication failed';
      }
  
  } else {
  
   echo "No Such User";
  include 'login.php';
  exit();
  }
  
  echo "$what\n";
  echo "&lt;br /&gt;";
  echo "$hash";
  
  ?&gt;
  </code></pre>
  
  <p>THIS IS MY WORKING CODE FOR BENEFIT OF OTHERS:</p>
  
  <pre><code>&lt;?php
  
  // Inialize session
  session_start();
  
  // Include database connection settings
  include('config.inc');
  
  require("PasswordHash.php");
  $hasher = new PasswordHash(8, false);
  
  $username = $_POST['username'];
  $password = $_POST['password'];
  
  // Passwords should never be longer than 72 characters to prevent DoS attacks
  if (strlen($password) &gt; 72) { die("Password must be 72 characters or less"); }
  
  $query = "SELECT * FROM user WHERE username = '$username'";
  
  $query = mysql_query($query);
  $numrows = mysql_num_rows($query);
  
  if ($numrows = 1) {
  
  
  $res = mysql_query("SELECT * FROM user WHERE username = '$username'"); 
  $row = mysql_fetch_array($res); 
  $hash = $row['password']; 
  $password = $_POST['password'];
  
  if ($hasher-&gt;CheckPassword($password, $hash)) { //$hash is the hash retrieved from the      DB 
          $what = 'Authentication succeeded';
      } else {
          $what = 'Authentication failed';
      }
  
  } else {
  
   echo "No Such User";
  include 'login.php';
  exit();
  }
  
  echo "$what\n";
  echo "&lt;br /&gt;";
  echo "$hash";
  
  ?&gt;
  </code></pre>