Login with password_hash()

Question

I am learning from a book, which uses SHA1. I've changed the code to password_hash(), by checking online. Here I query only the password and verify it. I managed get it working, but I feel a bit paranoid about the code. Is the code proper or wrong?

At registration:

//at registration    
$p=mysqli_real_escape_string($dbcon, trim($_POST['psword1']));
$hash =  password_hash($p,PASSWORD_DEFAULT);
//stores $hash in db.

At login:

<?php 
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    //connect to db
    require ('mysqli_connect.php');
    //validate the email
    if (!empty($_POST['email'])){
       $e = mysqli_real_escape_string($dbcon, $_POST['email']);
       }else {
       $e = FALSE;
       echo '<p class="error"> You forgot to enter your email.</p>';
    }
// validate the password
if (!empty($_POST['psword'])){
      $p=mysqli_real_escape_string($dbcon,$_POST['psword']);
   } else {
       $p = FALSE;
       echo '<p class="error">You forgot to enter your password.</p>';
     }
      if (!empty($e && $p )){
        //get email info
             $sql = "SELECT  psword FROM users WHERE email = '$e'  LIMIT 1";
             $query = mysqli_query($dbcon,$sql);
             $row = mysqli_fetch_row($query);
             $dbpassword=$row[0];


        //run if email and password got value
        if (password_verify($p,$dbpassword)){ 
          // Retrieve the user_id, first_name 
          $q = "SELECT user_id, fname, user_level,lname,registration_date FROM users WHERE (email='$e')";
          // Run the query and assign it to the variable $result
          $result = mysqli_query ($dbcon, $q);
          // Count the number of rows that match the email/password combination
          if (@mysqli_num_rows($result) == 1) {//if one database row (record) matches
            // Start the session, fetch the record and insert the three values in an array
            session_start(); 
            $_SESSION = mysqli_fetch_array ($result, MYSQLI_ASSOC);
            // Ensure that the user level is an integer.
            $_SESSION['user_level'] = (int) $_SESSION['user_level'];
            // Use a ternary operation to set the URL
            $url = ($_SESSION['user_level'] === 1) ? 'index.php' : 'members.php';
            header('Location: ' . $url); // Make the browser load either the members’ or the admin page
            exit(); // Cancel the rest of the script
            mysqli_free_result($result);
            mysqli_close($dbcon);
        } else { // No match was made.
            echo '<p class="error">The e-mail address and password entered do not match our records <br>Perhaps you need to register, just click the Register button on the header menu</p>';
          }
          } else { // If there was a problem.
            echo '<p class="error">Please try again.</p>';
            }

   }
mysqli_close($dbcon);
}
?>

Answer 1

PLEASE do not do anything to the password prior to hashing it. Do not escape it. Do not trim() it. Just pass it directly to password_hash.

Secondly, you never fetch the hash from the database. That looks weird that you have a magic $dbpassword variable...

Third: Please use prepared statements. Escaping can be secure, but prepared statements are so much easier to verify and work with.

Fourth: Don't close the connection all over the place like that. Let it get closed for you by the script end, that way you don't need to reconnect multiple times in the same script.

Fifth: Please use consistent indentation. It will make your life a LOT easier.