Password hashing

...

Code:

string(45) "$2y$10$B7uJAngw0wtDtncMpsOfvetyFCg//VqdnqjdEZ" bool(false)

...

the password_verify() always is FALSE !  

This is an incomplete hash, probably truncated by a field-length limit that you've set on your database table. bcrypt produces a 60-character hash, yours is only 45 and it could never validate (actually, it probably contains just the salt).

The solution is to change your password field to varchar(255) (yes, 255; for forward-compatibility) and re-hash your passwords.

Also, you should implement a minimum password length policy ... I know you're probably just testing right now, but no one should ever be allowed to use 'zz' as a password.