What are the best practices for securely storing and comparing hashed passwords in PHP?

When storing and comparing hashed passwords in PHP, it is important to use a strong hashing algorithm like bcrypt, properly salt the passwords before hashing, and securely store the salt along with the hashed password. When comparing passwords, always use a secure comparison function like password_verify to prevent timing attacks. 

// Storing a hashed password
$password = 'password123';
$salt = random_bytes(16); // Generate a random salt
$hashedPassword = password_hash($password . $salt, PASSWORD_BCRYPT);

// Comparing a hashed password
$userInput = 'password123';
if(password_verify($userInput . $salt, $hashedPassword)) {
    echo 'Password is correct!';
} else {
    echo 'Password is incorrect!';
}

Keywords

password hashing password_verify password_hash bcrypt salting

Related Questions