info/php-the-right-way
1
0
Fork 0
mirror of https://github.com/codeguy/php-the-right-way.git synced 2025-08-14 01:33:58 +02:00
Code Issues Projects Releases Wiki Activity

The example I had before is not actually helpful for users, this one is much more relevant

Browse Source
This commit is contained in:
Sean DuBois
2012-12-06 04:44:29 -05:00
parent bbb5d0346c
commit 6d62e643f7
1 changed files with 4 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
_posts/07-03-01-Password-Hashing.md
View File

@@ -12,20 +12,16 @@ It is important that you properly [_hash_][3] passwords before storing them. Pas
In PHP 5.5 `password_hash` will be introduced. At this time it is using BCrypt, the strongest algorithm currently supported by PHP. It will updated in the future to support more algorithms as needed though. The `password_compat` library was created to provide forward compatibility for PHP >= 5.3.7.
Below we hash two strings, but because the two hashes do not match the user will be denied login.
Below we hash a string, we then check the hash against a new string. Because our two source strings are different ('secret-password' vs. 'bad-password') this login will fail.
{% highlight php %}
<?php
require 'password.php';
$hash1 = password_hash("secret-password", PASSWORD_DEFAULT);
$hash2 = password_hash("wrong-password", PASSWORD_DEFAULT);
$passwordhash = password_hash('secret-password', PASSWORD_DEFAULT);
//$hash1 == $2y$10$EjIg0Uupiwq7WeZEghz1PumEoBX3v/.eGWHaJGxCe.2tTKe90GM5e
//$hash2 == $2y$10$CxowuHb7aDogobMRbLLPDubgzMJ7oO3DErtpvpIV20tLOXY26t7Ay
if ($hash1 == $hash2) {
//Welcome!
if (password_verify('bad-password', $password-hash)) {
//Correct Password
} else {
//Wrong password
}