How can a PHP User class securely handle password verification and updates without exposing the password?

When handling password verification and updates in a PHP User class, it is important to securely hash passwords using a strong hashing algorithm like bcrypt. This ensures that passwords are not stored in plain text and are securely stored in the database. To verify passwords, compare the hashed password stored in the database with the hashed input password. When updating passwords, generate a new hash for the updated password before storing it in the database. 

class User {
    private $username;
    private $passwordHash;

    public function setPassword($password) {
        $this->passwordHash = password_hash($password, PASSWORD_BCRYPT);
    }

    public function verifyPassword($password) {
        return password_verify($password, $this->passwordHash);
    }

    public function updatePassword($newPassword) {
        $this->setPassword($newPassword);
    }
}

Keywords

PHP User class password verification password updates security

Related Questions