php - hashing password in registration different from the login password -

this question has answer here:

• hashing password using crypt not work on login displays incorrect pass 2 answers

i have registration page allows users insert password. hash password upon registration stored more securely in database.

when user logs in same password, 2 hashes don't match , user cannot log in.

this first time using hash , didn't behave expected:

this hashing code on registration page:

$salt ="";      function cryptpass($input, $rounds = 9) {     $salt = "";     $saltchars = array_merge(range('a','z'), range('a','z'), range('0','9'));     for($i = 0; $i<22; $i++)     {         $salt  .=$saltchars[array_rand($saltchars)];      }     return crypt($input, sprintf('$2y$%02d$test$', $rounds) . $salt); } $hashedpass = cryptpass($pass1);       echo $hashedpass; //************insert members's input database**************************//       $query = mysql_query("insert members(user_name, first_name, last_name, governorate, district, village, birth_date, email_address, specialization, password, salt, registered_date )values('$username', '$firstname', '$lastname', '$governorate', '$district', '$village', '$bdate', '$email', '$specialization', '$hashedpass', '$salt',  now())")or die(mysql_error());     

i did add salt give empty

this hashing code on login page

function cryptpass($input, $rounds = 9) {     $salt = "";     $saltchars = array_merge(range('a','z'), range('a','z'), range('0','9'));     for($i = 0; $i<22; $i++)     {         $salt  .=$saltchars[array_rand($saltchars)];      }     return crypt($input, sprintf('$2y$%02d$test$', $rounds) . $salt); } $hashedpass = cryptpass($pass);    echo $hashedpass;   $sql=mysql_query( "select user_id, email_address, first_name, user_name members email_address='$email'and password= '$hashedpass' limit 1") or die("error in members table"); $login_check = mysql_num_rows($sql);    if($login_check > 0)the hashing password = $2y$09$test$4zggcixdkzgqvuzwu.axfdwvzaddce.ld6hckrk3zsqjen7e  

when user registers need store both salt , hashed password in database. when user tries log in need use same salt when registered, otherwise hash different. called per-user salt , more secure option.

a simpler, though less-secure option generate single salt value application , use users. have effect of keeping passwords hashed in database less secure because if salt value compromised it's trivial matter brute-force hashed passwords.