What are the security risks associated with storing passwords directly in a database in PHP?

Storing passwords directly in a database in PHP poses a security risk because if the database is compromised, all passwords can be easily accessed. To mitigate this risk, passwords should be securely hashed before storing them in the database. This adds an extra layer of security by converting the password into a unique string of characters that cannot be reversed to reveal the original password. 

// Hashing the password before storing it in the database
$password = "mySecurePassword123";
$hashed_password = password_hash($password, PASSWORD_DEFAULT);

// Storing the hashed password in the database
$stmt = $pdo->prepare("INSERT INTO users (username, password) VALUES (:username, :password)");
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $hashed_password);
$stmt->execute();

Keywords

SQL injection password hashing bcrypt password salting secure authentication

Related Questions