Qfyilyi

I'm working on this login form at the moment (I didn't paste the code but it is above my posted code in my file). Basically, when I create a new user I want a random password to be generated (which in the future will be emailed to the user). For that reason I decided not to encrypt the randomly generated password and it's giving me trouble now... My below code is attempting to redirect people with active = 0 to the first_login page, where they will be forced to change their password which will turn them into an active user. But I want people with active = 1 to be able to login with their encrypted password. Please tell me what I'm doing wrong and thanks for your help. Check out my code below.......

session_start();

   include($_SERVER['DOCUMENT_ROOT'].'/crm/connect/db.php');

   mysqli_select_db($conn, 'users');



if($_SERVER["REQUEST_METHOD"] == "POST") {

    $user=mysqli_real_escape_string($conn,$_POST['user']);

    $pass=mysqli_real_escape_string($conn,$_POST['pass']);

    $hashedpassword = password_hash ($pass, PASSWORD_DEFAULT);

    $sql="select * from users where username ='$user'";

    $result=mysqli_query($conn,$sql);

    $row=mysqli_fetch_array($result, MYSQLI_ASSOC);

    $role = $row["admin"];



if ($row["active"] == 0 && $pass = $row["password"]){

    header('location:initial_login.php');

}

    elseif(password_verify($pass, $row["password"])){

        $_SESSION['username'] = $user;

        $_SESSION['admin'] = $role;

           header('location:index.php');

    }else{

          echo 'incorrect!';

    }

 }

/// PROBLEM SOLVED - changed $pass = $row["password"] to $pass == $row["password"] ///

session_start();

include($_SERVER['DOCUMENT_ROOT'].'/crm/connect/db.php');

mysqli_select_db($conn, 'users');

    if($_SERVER["REQUEST_METHOD"] == "POST") {

       $user=mysqli_real_escape_string($conn,$_POST['user']);

       $pass=mysqli_real_escape_string($conn,$_POST['pass']);

       $hashedpassword = password_hash ($pass, PASSWORD_DEFAULT);

       $sql="select * from users where username ='$user'";

       $result=mysqli_query($conn,$sql);

       $row=mysqli_fetch_array($result, MYSQLI_ASSOC);

       $role = $row["admin"];





 if ($row["active"] == 0 && $pass == $row["password"]){

     header('location:initial_login.php');

      }else{

        echo 'incorrect!';

 if(password_verify($pass, $row["password"])){

      $_SESSION['username'] = $user;

      $_SESSION['admin'] = $role;

         header('location:index.php');

     }else{

       echo 'incorrect!';

    }

  }

 }