mysql - Trying to create a page that if it's the first time logging in checks against a plain text password else checks against a hashed pass (php) -

dang title bad.

i working on site bunch of users imported use of csv file. csv file includes first name, last name, email etc. before file uploaded db running through program takes last name , appends last 4 digits of 7 digit number in csv , assigning password value. when user logs in first time redirects page enter new password gets hashed , stored in db using password_hash function. redirects them home page.

on sign in page first checks against db plain text password entered (i know terrible way of doing , i'm trying find way this... leave answers well!) if returns no results query's db hashed pass , stores in variable. run password_verify function , fails when know entered in right pass. var_dump(ed) hashed var , echoed pass entered run through password_hash function. don't match , don't know why. here relevant code.

    if (!empty($_post)){       $lname = $_post['lname'];     $pass = $_post['pass'];      //region prepare mysqli statement , run     //prepare query     $stmt = $con->prepare("select id, lname, password users lname = ? , password = ?");      //bind parameters     $stmt->bind_param("ss", $lname, $pass);      //run query     $stmt->execute();      //get results     $results = $stmt->get_result();      //make results usable     $row = $results->fetch_object();         //endregion      //check make sure results returned , stores user id session variable if true     if (!empty ($row)){         $_session['user'] = $row->id;         unset($_post);          header('location: home.php');            }elseif (empty ($row)){        $hasho=$con->query('select password users lname = "' .$lname. '"');     $hash = $hasho->fetch_object();      $passh = password_hash($pass, password_default);     if ($passh == $hash) {         $_session['user'] = $row->id;     unset($_post);      header('location: home.php');   } else {     echo "invalid credentials"; }     } } 

i'm sure i'm doing stupid code.

thank you!

you cannot use function password_hash() verify password, because of salt randomly choosen.

$passh = password_hash($pass, password_default); if ($passh == $hash) { // hashes never comparable 

instead should use password_verify() function check password:

if password_verify($pass, $hash) {