title: Comparing hash value of password in PHP
body: <p>As part of learning php, I wanted to try a register and login page, however, the <a href="http://alias.io/2010/01/store-passwords-safely-with-php-and-mysql/" rel="nofollow">site</a> I'm following for how to store a password uses MySQLI and I'm not using that:</p>
  
  <p><strong>Hashing the password</strong></p>
  
  <pre><code>$password1 = 'hello123';
  // A higher "cost" is more secure but consumes more processing power
  $cost = 10;
  
  // Create a random salt
  $salt = strtr(base64_encode(mcrypt_create_iv(16, MCRYPT_DEV_URANDOM)), '+', '.');
  
  // Prefix information about the hash so PHP knows how to verify it later.
  // "$2a$" Means we're using the Blowfish algorithm. The following two digits are the cost parameter.
  $salt = sprintf("$2a$%02d$", $cost) . $salt;
  
  // Value:
  // $2a$10$eImiTXuWVxfM37uY4JANjQ==
  
  // Hash the password with the salt
  $hash = crypt($password1, $salt);
  </code></pre>
  
  <p>I'm stuck on retrieving the password however, here's the site's code for it:</p>
  
  <pre><code>$username = 'Admin';
  $password = 'gf45_gdf#4hg';
  
  $sth = $dbh-&gt;prepare('
    SELECT
      hash
    FROM users
    WHERE
      username = :username
    LIMIT 1
    ');
  
  $sth-&gt;bindParam(':username', $username);
  
  $sth-&gt;execute();
  
  $user = $sth-&gt;fetch(PDO::FETCH_OBJ);
  
  // Hashing the password with its hash as the salt returns the same hash
  if ( crypt($password, $user-&gt;hash) === $user-&gt;hash ) {
    // Ok!
  }
  </code></pre>
  
  <p>From what I can see, he grabs the hash value of the password for the user in the DB and compares the password that was passed using the hash and check with the one in the DB.</p>
  
  <p>I've been trying this but the result hash is never the same as the original one:</p>
  
  <pre><code>$pwdtocheck = 'hello123';
  
  // no call do DB yet, doing this on the same page after hashing, the $hash is the same as above
  $pwdhash = crypt($pwdtocheck, $hash);
  
  // if I echo $pwdhash it's never exactly the same as the $hash.
  if ( $pwdhash === $hash) {
    echo "same pwd";
  }
  </code></pre>