title: How do I verify a hashed password?
body: <p>Upon registering a new user, the code uses BCRYPT and MD5 to create a hash, like this: </p>
  
  <pre><code>$password = $mysqli-&gt;escape_string(password_hash($_POST['password'], 
  PASSWORD_BCRYPT));
  $hash = $mysqli-&gt;escape_string( md5( rand(0,1000) ) );
  </code></pre>
  
  <p>Once user name, password, and hash are in the SQL database, I want to verify the password. The problem is that the code below is comparing the hashed password to the password typed into the form... </p>
  
  <p>How do I compare the password typed into the form to the hashed password stored in the database? </p>
  
  <p>I have the following code: </p>
  
  <pre><code>function getLogin($conn) {
    if (isset($_POST['loginSubmit'])){
  
  
    $email = $_POST['email'];
    $password = $_POST['password'];
  
    $sql = "SELECT * FROM users WHERE email='$email' AND password='$password'" ;
    $result = mysqli_query($conn, $sql);
    if(mysqli_num_rows($result) == 1) {
      if($row = $result-&gt;fetch_assoc()) {
        $_SESSION['id'] = $row['id'];
        $_SESSION['email'] = $row['email'];
  
        header("Location: indexcomments_merge.php?logiinsuccess");
        exit();
      }
    } else {
        header("Location: indexcomments_merge.php?logiinfailed");
        exit();
     }
    } 
  }
  </code></pre>