What are the best practices for comparing login data from a form with a database in PHP?

When comparing login data from a form with a database in PHP, it is important to securely hash the password before storing it in the database and then verify the hashed password when comparing it with the input from the login form. This helps protect user data in case of a data breach. Additionally, using prepared statements can help prevent SQL injection attacks. 

// Assuming $username and $password are obtained from the login form
$username = $_POST['username'];
$password = $_POST['password'];

// Connect to the database
$pdo = new PDO('mysql:host=localhost;dbname=your_database', 'username', 'password');

// Prepare a SQL statement to retrieve the hashed password for the given username
$stmt = $pdo->prepare('SELECT password FROM users WHERE username = :username');
$stmt->execute(['username' => $username]);
$user = $stmt->fetch();

// Verify the password
if ($user && password_verify($password, $user['password'])) {
    // Password is correct, proceed with login
    echo 'Login successful';
} else {
    // Password is incorrect
    echo 'Login failed';
}

Keywords

password_hash password_verify prepared statements PDO SQL injection

Related Questions