using phppas blowfish encryption (used by wordpress)

Question

here is the site http://www.openwall.com/phpass/

whoever is familiar with this class, my question is this

i'll be using the class found on that page to hash the password for members. the code declaration looks something like this

require_once("password.hash.php");
$blowfish = new PasswordHash(8, FALSE);
$blowfish->HashPassword($_POST['password']);

i noticed that when the password is entered in a textfield say i enter the password "sarmenhb" the hash that gets created doesnt stay the same where if i did it with md5. i noticed the password keeps changing everytime i enter sarmenhb.

how would i check to see if the password entered by the user matches against what is in the database??

i tried this

$blowfish->checkpassword($_POST['password'],"password in db");

but nothing shows up the screen is blank.

im doing this in testing that is why the fields arent escaped i just want to see if it works. but im getting no results... is there an alternative??

ps: im not doing this for wordpress its just locally on my own mvc.

=================================================== update:

i tried this

include("classes/hash.class.php"); 

$sec = new PasswordHash(8, FALSE);
$correct = "sarmenhb";
//pass generated from $sec->HashPassword($correct);
$hash = "\$P$\BeJb51gIUh8Qmb1DAW.Hkt1I4gnm2C1";
$check = $sec->CheckPassword($correct, $hash);

if($check) { print "correct"; }
else { print "incorrect"; }

and when i run it the output keeps showing incorrect.

Answer 1

In the hash variable you have the slashes to escape the $ however those slashes are then part of the actual string when the hash checks for $P$ to be the first 3 characters of the string. If you change it to single quotes, and remove the slashes it will work

$hash = '$P$BeJb51gIUh8Qmb1DAW.Hkt1I4gnm2C1';

I'm rather confused though by you saying nothing shows up when doing $blowfish->checkpassword($_POST['password'],"password in db");, of course nothing will show it, it returns true or false but it won't print anything unless combined with more code. Be sure the password stored in the database isn't escaped or altered in some form. Try printing the variable your using for it?

The hashed password doesn't stay the same because it is being salted on each time it is used, it's ok because the hash contains the salt where it can be found later to compare. Salts are just random characters/numbers/symbols to add more variance to the hash to make it difficult to crack.