When a user logs in we're comparing the username and password they supply in the log in farm to have
these values in their database.
At the moment were storing the password in clear text.
In other words you can read it.
Storing passwords in clear text in the database like this is a very bad idea.
If a hacker manages to get hold of your database then they have a list of usernames and passwords they
can use to log in to your site.
Also people tend to reuse the same password across multiple sites.
I've done that myself so this arsehole gives a hacker potential to use these credentials on other sites
too.
So instead of storing them in plain text we want to hide them in some way so that even if someone gets
access to the database they can't read them.
We can do this by hashing the passwords using a hash function a hash function simply transforms a string
into another string which is called a hash.
This is known as a one way function.
It only works transforming the original string into the hash.
However it's impossible to work out what the original string was.
If you only know the hash.
This is why this is not encryption with encryption.
You could get back to the original string again.
R d Krypto it.
If you want it to with a hash there's no way to d hash it.
There are several hash functions available in P HP that use different hashing algorithms.
For example n d 5 s h 1 and a general hash function that you can specify different algorithms with.
However as you can see from the documentation using these hashing algorithms is not recommended for
hashing passwords as even though they are one way functions.
It can be easy to calculate the original string from the hash.
So these are insecure.
Fortunately we don't need to worry about which algorithm to use when hashing passwords.
P HP has a function designed specifically for securely hashing passwords.
This uses one of the most secure hashing algorithms available and also uses a technique called salted
hashing which makes it even more secure.
Let's look at an example in a new file called hashing example that p p.
Let's add a variable with a password in it and then create a hash of that password by calling the password
hash method.
The second argument to the password hash function is which algorithm to use.
There are a few options for this but the best one to use is password default.
Using this constant will use the best algorithm available at the time.
So if a new stronger hashing algorithm is added to p HP The next time you use this method that algorithm
will be used.
Details of which algorithm was used in generating their hash are contained inside the hash string itself
so you dont need to remember which one was used.
If we do use this one then the documentation recommends stirring the hash in a database column of 255
characters in length which is the length of the password column we created in the user table earlier.
So let's use password default.
In our example code.
Then let's just close out this value.
When we run this cold and view the results in the browser there's the hash of the password.
Note that if I refresh the page the hash changes even though the password is staying the same.
This is because of random characters called a salt added to the password before it's hashed.
This data is stored with this hash string though so it's not necessary to remember it separately.
It's all dealt with automatically by p p.
Let's copy this hash value
and then back in the code will comment out these two lines and assign the value we just copied to the
hash variable.
To verify that a password matches a hash we use the password verify function which returns true if a
password and hash match and false otherwise.
So let's call this function and just dump out the results passing in the password and hash value we
just generated.
And as that hash was generated from that same password the function returns true.
If we change the password.
Then the function returns FALSE.
So this is the secure way to deal with passwords in P HP.
The password hash function is used to generate to secure a password hash.
And this is what stood in the database when a user supplies a password on a log in page for example
the password verify function is used to check if this matches the stored hash.