PHP PDO Error when fetching hashed strings from SQL table
<p>As I was changing my <code>MySQLi</code> to <code>PDO</code>, I encountered an error when fetching hashed strings from my <code>users</code> table.</p>

<p>This was the code I used before:</p>

<p><em><code>CheckPassword</code> VERIFIES <strong>VALID</strong> USING <code>MYSQLI</code></em></p>

<pre><code>$mysqli = new mysqli("localhost","_USER_","_PASS_","_DB_");

$username = '_USERNAME_';
$pass = '_PASSWORD_';
$sql = "SELECT * FROM `users` WHERE username='$username' LIMIT 1";
$result = $mysqli-&gt;query($sql);
if($assoc = $result-&gt;fetch_assoc()){
    $db_pass = $assoc['userpass'];

    require 'PasswordHash.php';
    $hash_cost_log2 = 8;
    $hash_portable = FALSE;
    $hasher = new PasswordHash($hash_cost_log2, $hash_portable);

    if($hasher-&gt;CheckPassword($pass, $db_pass)) {
       echo "valid"; // VERIFIES VALID
    } else {
       echo "invalid";
   }
}
</code></pre>

<p>The reason why I switched to <code>PDO</code> was to prevent <strong>SQL Injections</strong>.</p>

<p>But now: <em><code>CheckPassword</code> VERIFIES <strong>INVALID</strong> USING <code>PDO</code></em></p>

<pre><code>$pdo = new PDO('mysql:dbname=_DB_;host=localhost', '_USER_', '_PASS_',
array(PDO::ATTR_ERRMODE =&gt; PDO::ERRMODE_EXCEPTION));

$username = '_USERNAME_';
$pass = '_PASSWORD_';
$stmt = $pdo-&gt;prepare('SELECT * FROM `users` WHERE username = :u LIMIT 1');
$stmt-&gt;bindParam(':u', $username);
$stmt-&gt;execute();
if($fetch = $stmt-&gt;fetch(PDO::FETCH_ASSOC)){
    $db_pass = $fetch['userpass'];

    require 'PasswordHash.php';
    $hash_cost_log2 = 8;
    $hash_portable = FALSE;
    $hasher = new PasswordHash($hash_cost_log2, $hash_portable);

    if($hasher-&gt;CheckPassword($pass, $db_pass)) {
       echo "valid";
    } else {
       echo "invalid"; // VERIFIES INVALID
   }
}
}
</code></pre>

<p>How is it that; <code>MySQLi</code> fetches the <em>hashed string</em> different compared to <code>PDO</code>? No matter what encryption I use for hashing the passwords, it <strong>CANNOT</strong> validate them as true when fetching using <code>PDO</code>, <strong>BUT</strong> only when fetching using <code>MySQLi</code>?</p>