Inconsistent behavior in password_verify about password_compat HOT 4 OPEN

Can you post your code? Without it is hard to determine what is going on, as I (and I gues lots of others), don't experience this problem.

from password_compat.

In one of my PHP files (processSignup.php) that involves storing the hashed password:

$password = $_POST['password'];

$password = $mysqli->real_escape_string($password);

$securePassword = password_hash($password, PASSWORD_BCRYPT);

then the $securePassword variable is stored into a MySQL database with the following parameters in my prepared statement:

$statement = $mysqli->prepare("INSERT INTO users SET `username` = ?, `password` = ?, `email_address` = ?, `signup_ts` = ?, `isadmin` = ?");

$statement->bind_param('sssdd',$username, $securePassword, $email, time(), $defaultAdmin);

For the verification of password (loginProcess.php), which involves retrieving the hashed password and then verifying it with the password inputted for the specified user:

$password = $_POST['password'];

$password = $mysqli->real_escape_string($password);

$statement = $mysqli->prepare("SELECT userid, username, password, email_address, isadmin, isbanned FROM users WHERE `username`=?");
...
$statement->bind_result($a, $b, $c, $d, $e, $f);
  while ($statement->fetch()) {
    $user[] = ['userid' => $a, 'username' => $b, 'password' => $c, 'email_address' => $d, 'isadmin' => $e, 'isbanned' => $f];
  }

$verifiedPassword = password_verify($password, $user['password']);

However, whenever I restart my PHP server, $verifiedPassword always returns false, no matter when the password was hashed. The $user array returns fine whenever I debug it through print($user);

Also, in my MySQL table, password is a VARCHAR with 255 character length.

from password_compat.

$password = $mysqli->real_escape_string($password);

What's with that line? It might be the cause of your issues.

from password_compat.

Also, $user is a 2-dimensional array, yet you're accessing it as a single-dimensional array. It should be something like $user[0]['password'] in the last line (assuming that you're correctly checking for errors and no-returns).

from password_compat.