Hash and verify a password in PHP

Php

password_hash picks the algorithm and the salt. Never store anything a hash function can reverse.

$hash = password_hash($plain, PASSWORD_DEFAULT);

if (password_verify($submitted, $hash)) {
    if (password_needs_rehash($hash, PASSWORD_DEFAULT)) {
        $hash = password_hash($submitted, PASSWORD_DEFAULT);
    }
}

Download

PHP php security passwords chris

More in PHP

Escape output in a PHP template PHP htmlspecialchars with the flags spelled out, because the defaults have changed between versions. Prepared statement with PDO PHP Placeholders rather than interpolation. This is the whole of SQL injection defence in PHP.

Random picks

An RSS feed skeleton Data Formats The minimum a reader needs. Dates must be RFC 822, which is the part most generators get wrong. Merge dictionaries Python The | operator returns a new dict; |= updates in place. Later keys win in both. Read a file into a string in Go Systems os.ReadFile replaced ioutil.ReadFile in 1.16 and is the one-liner for small files. Sum a column with awk Text Processing Adds the third field of every line and prints the total, ignoring anything non-numeric. Group rows into a JSON array Databases Returns one row per author with their posts nested, instead of a join that repeats the author on every row. Find the commit that introduced a bug Git Binary search across history. Mark a known good and a known bad commit and git narrows it down for you. A test that fails for the right reason Testing Assert on the message, not merely that something threw. A typo raising TypeError would otherwise pass. Run a command on every file changed in a commit Shell Lints only what a commit touched, which is usually all you need in a pre-commit hook.