PHP Login Authentication with BCrypt

Question

I have a php authentication script and everything works fine, but I'm very unsure about the way I programmed it (I hardcoded some things). I was hoping stack could look through this and point out any potential problems. Here's the script:

<?php
require_once 'Bcrypt.php';
class Mysql {
 private $conn;
 function __construct() {
 $this->conn = new PDO('mysql:host=***;dbname=***;charset=UTF-8','***','***') or 
 die('There was a problem connecting to the database.');
 }
 function verify_Username_and_Pass($un, $pwd) {
 ini_set('display_errors', 'On');
 error_reporting(E_ALL | E_STRICT);
 $query = "SELECT *
 FROM Conference
 WHERE Username = :un";
 $stmt = $this->conn->prepare($query);
 $stmt->bindParam(':un', $un);
 //$stmt->bindParam(':pwd', $pwd);
 $stmt->execute();
 $row = $stmt->fetchAll();
 $hash = $row[0]["Password"];
 $is_correct = Bcrypt::check($pwd, $hash);
 if ($is_correct) {
 // User exist
 $firstName = $row[0]["First Name"];
 $_SESSION["FirstName"] = $firstName;
 return true;
 $stmt->close();
 }
 else {
 // User doesn't exist
 return false;
 $stmt->close();
 }
 }
}
?>

So how does it look?

Answer 1

I've tried cleaning it up a bit here, removed instances of setting a variable once and using it directly below where it was set (yes, improves readability, but still).

require_once 'Bcrypt.php';
class Mysql {
 private $conn;
 private $host = 'host';
 private $dbName = 'dbname'; 
 private $charset = 'UTF-8';
 private $checkUserQuery = 'SELECT * FROM Conference WHERE Username = :un';
 function __construct() {
 $this->conn = new PDO('mysql:host=' . $this->host . ';dbname=' . $this->dbname . ';charset=' . $this->charset) 
 or die('There was a problem connecting to the database.');
 }
 function verifyUsernameAndPass($un, $pwd) {
 $stmt = $this->conn->prepare($this->checkUserQuery);
 $stmt->bindParam(':un', $un);
 #$stmt->bindParam(':pwd', $pwd);
 $stmt->execute();
 $row = $stmt->fetchAll();
 $stmt->close(); # Moved up, so closes before we return/exit function
 # You're setting $hash here, and using it directly below.
 # See new code below
 //$hash = $row[0]['Password'];
 //$is_correct = Bcrypt::check($pwd, $hash);
 //if ($is_correct) {
 if( Bcrypt::check($pwd, $row[0]['Password']) ){
 # User exist
 # You're setting $firstName once, and using it directly below it.
 # See new code below
 //$firstName = $row[0]['First Name']; 
 //$_SESSION['FirstName'] = $firstName;
 $_SESSION['FirstName'] = $row[0]['First Name'];
 return true;
 } else {
 # User does not exist
 return false;
 }
 }
}

And here's the same code, without my comments:

require_once 'Bcrypt.php';
class Mysql {
 private $conn;
 private $host = 'host';
 private $dbName = 'dbname'; 
 private $charset = 'UTF-8';
 private $checkUserQuery = 'SELECT * FROM Conference WHERE Username = :un';
 function __construct() {
 $this->conn = new PDO('mysql:host=' . $this->host . ';dbname=' . $this->dbname . ';charset=' . $this->charset) 
 or die('There was a problem connecting to the database.');
 }
 function verifyUsernameAndPass($un, $pwd) {
 $stmt = $this->conn->prepare($this->$checkUserQuery);
 $stmt->bindParam(':un', $un);
 $stmt->execute();
 $row = $stmt->fetchAll();
 $stmt->close();
 if( Bcrypt::check($pwd, $row[0]['Password']) ){ # User exists
 $_SESSION['FirstName'] = $row[0]['First Name'];
 return true;
 } else { # User does not exist
 return false;
 }
 }
}