What are some potential pitfalls of comparing passwords in PHP using unsafely stored values in a database?

Storing passwords unsafely in a database, such as in plain text or using weak encryption, can lead to security vulnerabilities if the database is compromised. When comparing passwords in PHP, it is important to securely hash the input password and compare it to the hashed password stored in the database. This ensures that even if the database is breached, the passwords are not easily readable. 

// Safely compare passwords using password_verify function
$input_password = $_POST['password'];
$stored_password = getPasswordFromDatabase(); // Function to retrieve hashed password from database

if (password_verify($input_password, $stored_password)) {
    // Passwords match
    echo "Password is correct!";
} else {
    // Passwords do not match
    echo "Incorrect password.";
}

Keywords

password hashing SQL injection password_verify password_hash bcrypt

Related Questions