ValidatePassword() not giving expected result

Okay, so i am trying to return a user record, basing on their phone number and password.

when i provide the right password, it says invalid password, I think it is something wrong with my code, because it works on the front end, and actually logs me in.

Here is the code


 <?php

namespace api\modules\v1\controllers;


use yii\rest\Controller;

use yii\data\SqlDataProvider;

use yii\web\Response;

use yii;

use common\models\User;


class UserController extends ApiController{


    const STATUS_DELETED = 0;

    const STATUS_ACTIVE = 10;

    public $phone;

    public $password;

    private $_user = false;

    private $password_hash;


	public function actionIndex(){

		if(isset($_GET['phone']) && isset($_GET['password']))

        {

            $this->phone = $_GET['phone'];

            $this->password = $_GET['password'];

            if(!is_null($this->getUser($this->phone)))

            {

                //if the user is there, we try and validate the password

                if (Yii::$app->getSecurity()->validatePassword($this->password, $this->_user->password_hash))

                {

                    echo ("good password");

                    return $this->_user;

                } else

                {

                    echo('bad password');

                }

            }else

            {

                return['User Not Found, Please Check Your Credentials And Try Again'];

            }


		}

        else

        {

            if(!isset($_GET['phone']))

            {

              return array('Please provide your phone number');

            }

            if(!isset($_GET['password']))

            {

              return array('Please provide your password');

            }

		}

	}




    public function getUser($phone)

    {

        if ($this->_user === false) {

            $this->_user = User::findOne(['phone' => $phone,'status' => self::STATUS_ACTIVE ]);

        }

        return $this->_user;

    }







}

Problem is around line 27. It keep saying returning "bad password"