info/php-the-right-way
1
0
Fork 0
mirror of https://github.com/codeguy/php-the-right-way.git synced 2025-08-13 17:23:58 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #220 from Sean-Der/gh-pages

Browse Source 
Prior hashing example was poor.
This commit is contained in:
Phil Sturgeon
2012-12-06 04:30:13 -08:00
parent bbb5d0346c 6d62e643f7
commit 19b0d7b6f8
1 changed files with 4 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
_posts/07-03-01-Password-Hashing.md
View File

@@ -12,20 +12,16 @@ It is important that you properly [_hash_][3] passwords before storing them. Pas
In PHP 5.5 `password_hash` will be introduced. At this time it is using BCrypt, the strongest algorithm currently supported by PHP. It will updated in the future to support more algorithms as needed though. The `password_compat` library was created to provide forward compatibility for PHP >= 5.3.7.
Below we hash two strings, but because the two hashes do not match the user will be denied login.
Below we hash a string, we then check the hash against a new string. Because our two source strings are different ('secret-password' vs. 'bad-password') this login will fail.
{% highlight php %}
<?php
require 'password.php';
$hash1 = password_hash("secret-password", PASSWORD_DEFAULT);
$hash2 = password_hash("wrong-password", PASSWORD_DEFAULT);
$passwordhash = password_hash('secret-password', PASSWORD_DEFAULT);
//$hash1 == $2y$10$EjIg0Uupiwq7WeZEghz1PumEoBX3v/.eGWHaJGxCe.2tTKe90GM5e
//$hash2 == $2y$10$CxowuHb7aDogobMRbLLPDubgzMJ7oO3DErtpvpIV20tLOXY26t7Ay
if ($hash1 == $hash2) {
//Welcome!
if (password_verify('bad-password', $password-hash)) {
//Correct Password
} else {
//Wrong password
}