php - mysql aes_encrypt and aes_decrypt -

i'm trying make login system encrypts , decrypt passwords in database(for project). can use aes_encrypt encrypt password , store them in database.however, when decrypt them later find matching passwords login, don't work. it's aes_decrypt skipped , not ran because have accounts plaintext password stored in database , can login them accounts encrypted passwords don't work. i'm using xampp phpmyadmin database.

signup file <?php  if(isset($_post['signup'])) { mysql_connect("localhost","root",""); mysql_select_db("faceback");  $email=$_post['email'];  $que1=mysql_query("select * users email='$email'"); $count1=mysql_num_rows($que1);  if($count1>0) { echo "<script> alert('there existing account associated email.'); </script>"; } else { $name=$_post['first_name'].' '.$_post['last_name']; $password=$_post['password']; $gender=$_post['sex']; $birthday_date=$_post['day'].'-'.$_post['month'].'-'.$_post['year']; $fb_join_date=$_post['fb_join_time'];  $day=intval($_post['day']); $month=intval($_post['month']); $year=intval($_post['year']); if(checkdate($month,$day,$year)) { $que2=mysql_query("insert  users(name,email,password,gender,birthday_date,fb_join_date)  values('$name','$email',aes_encrypt('$password','897sdn9j98u98jk'), '$gender','$birthday_date','$fb_join_date')");  session_start(); $_session['tempfbuser']=$email; }  login file <?php   if(isset($_post['login'])) { mysql_connect("localhost","root",""); mysql_select_db("faceback");  $user=$_post['username']; $pass=$_post['password'];    $que1=mysql_query("select email,aes_decrypt(password,'897sdn9j98u98jk')  users email='$user' , password='$pass'"); $count1=mysql_num_rows($que1);  if($count1>0) { session_start(); $_session['tempfbuser']=$user; } 

you save password database using aes_encrypt('$password','897sdn9j98u98jk' (in query).

but try retrieve plain-text password database using

$pass=$_post['password']; // code omitted $que1=mysql_query("select email,aes_decrypt(password,'897sdn9j98u98jk')  users email='$user' , password='$pass'"); //                            ^^^^^^^^^^^^^^^^^ 

that reason why can login on accounts have plaintext password stored in database.

to fix have search encrypted password in where clause:

(...) (...) , password = aes_decrypt($pass, '897sdn9j98u98jk') 

---

however:

you should not use encryption store passwords. should hash password using password_hash() , verify them using password_verify(). more information on why need hash password instead of encrypting them read fundamental difference between hashing , encryption algorithms.