Should passwords be directly compared with user input or with database entries in a PHP User class?

When comparing passwords in a PHP User class, it is best practice to compare the user input password with the hashed password stored in the database. This ensures that sensitive information is not exposed in case of a security breach. By hashing the user input password and comparing it with the hashed password in the database, you can verify if the passwords match without directly comparing plaintext passwords. 

class User {
    private $password;

    public function setPassword($password) {
        $this->password = password_hash($password, PASSWORD_DEFAULT);
    }

    public function verifyPassword($inputPassword) {
        return password_verify($inputPassword, $this->password);
    }
}

Keywords

passwords user input database entries PHP User class comparison

Related Questions