What best practices should be followed when comparing user input with stored credentials in a PHP login system to ensure security?

When comparing user input with stored credentials in a PHP login system, it's important to hash the password before storing it in the database and compare the hashed password with the hashed user input. This helps to ensure that the passwords are not stored in plain text and adds an extra layer of security to the system. 

// Hash the user input password
$user_input_password = $_POST['password'];
$hashed_user_input_password = password_hash($user_input_password, PASSWORD_DEFAULT);

// Fetch the stored hashed password from the database
$stored_password = "SELECT password FROM users WHERE username = :username";
// Execute the query and fetch the result

// Compare the hashed user input password with the stored hashed password
if(password_verify($hashed_user_input_password, $stored_password)) {
    // Passwords match, proceed with login
} else {
    // Passwords do not match, show error message
}

Keywords

password hashing password_verify prepared statements SQL injection bcrypt

Related Questions