mysql - PHP log in system password isn't matching -

i have made login system enables user sign in using defined email , password, in testing section, have noticed passwords don't match although know correct wrote test 1 down made it. cant seem see why happening, think may hashing of passwords don't know what.the login page check document, login.php:

    if(empty($errors)) {     $sql = "select accountid, password users emails=?";     $stmt = $pdo->prepare($sql);     $stmt->execute([$data['email']]);      if(!$row = $stmt->fetch())     {         // email didn't match         $errors['login'] = "login failed. on email";     }     else     {         // email matched, test password         if(!password_verify($data['password'],$row['password']))         {             // password didn't match             $errors['login'] = "login failed. on password";         }         else         {             // password matched             $_session['user_id'] = $row['accountid'];             header('location: welcome.php');             die;         }     } } 

the insertion database hashing is, insert.php:

    if (isset($_post['name'])){         $name = $_post['name'];     }     if (isset($_post['email'])){         $email = $_post['email'];     }     if (isset($_post['password'])){         $pword = $_post['password'];     }     if (isset($_post['busname'])){         $busname = $_post['busname'];     }      if (empty($name)){         echo("name required field");         exit();     }     if (empty($email)){         echo ("email required field");         exit();     }     if (empty($pword)){         echo("you must enter password");         exit();     }     $pword = password_hash($pword, password_default)."/n";    //insert html form database $insertquery= "insert  `cscw`.`users` ( `accountid` , `businessname` , `name` , `emails` , `password` ) values ( null ,  '$busname',  '$name',  '$email',  '$pword' );"; 

and on web page shown login.php, "login failed. on password". if need see more code please let me know.

it not recognize $row['password']. be organized query **
1)prepare
2)execute
3)fetch
4)close
5)then exploit fetched data. fetched data need sorted shown returnarray function.

hoping there unique emails , $data array exists.try this.

if(empty($errors)) {      $sql = "select accountid, password users emails=:emails";     $stmt = $pdo->prepare($sql);     $stmt->bindparam(':emails', $data['email']);     $stmt->execute();     $rows = $stmt->fetchall(pdo::fetch_assoc);     $stmt->closecursor();     $stmt=null;      /* return results more handy way */     function returnarray( $rows, $string )     {        foreach( $rows $row )        {            return $row[ $string ];        }     }     if( empty($rows) )    {    // email didn't match        $errors['login'] = "login failed. on email";    }    else    {      // email matched, test password        if( !password_verify( $data['password'], returnarray($rows,'password') ) )        {           // password didn't match           $errors['login'] = "login failed. on password";        }        else        {           // password matched           $_session['user_id'] = $row['accountid'];           header('location: welcome.php');           die;        }    } } 

---

the login page not finished query not inserting. carefull might vunerable sql injections because not escape user manipulated variables.(to strengthen security add form validation, great).

you have used $pword = password_hash($pword, password_default)."/n"; removed ."/n" part. seems using concatenation operator '.' add /n add end of password_hash.

your $insertquery not finished , not readable. don't need insert backticks in query. , no need select accountid autoincrement (see if a_i accountid ticked in database). in login page.

/* trim , escape*/ function escapehtmltrimed( $data ) {     $trimed = trim( $data );     $htmlentities = htmlentities( $trimed, ent_quotes | ent_html5, $encoding = 'utf-8' );     return $htmlentities; }   if ( isset( $_post['name'] ) ){     $name = escapehtmltrimed( $_post['name'] ); } if ( isset($_post['email']) ){     $email = escapehtmltrimed( $_post['email'] ); } if ( isset($_post['password']) ){     $pword = escapehtmltrimed( $_post['password'] ); } if ( isset($_post['busname']) ){     $busname = escapehtmltrimed( $_post['busname'] ); }  if ( empty($name) ){     echo("name required field");     exit(); } if ( empty($email) ){     echo ("email required field");     exit(); } if ( empty($pword) ){     echo("you must enter password");     exit(); } /*remove adding "./n"*/ $pword = password_hash($pword, password_default);    //insert html form database $insertquery= "insert users (businessname ,name ,emails,  password) values (:busname , :name, :email , :pword)"; $stmt = $pdo->prepare($insertquery); $stmt->bindparam(':busname', $busname); $stmt->bindparam(':name', $name); $stmt->bindparam(':email', $email); $stmt->bindparam(':pword', $pword); $stmt->execute(); $stmt->closecursor(); $stmt=null;