WEBVTT

00:04.490 --> 00:09.530
We're currently stirring the password for this user rijkaard in clear text.

00:09.530 --> 00:18.050
Now that we know this is a very bad idea let's change this to a hash instead to generate the hash you

00:18.050 --> 00:19.080
can use the script.

00:19.100 --> 00:21.280
We just used in the last lecture.

00:21.540 --> 00:30.260
Are find a web site like this one that will generate one for you using the P HP password hash function.

00:30.260 --> 00:39.650
When we enter the password click the hash button we get the hash.

00:39.650 --> 00:44.700
Now I dont recommend you use the word secret as a password on a life system.

00:44.810 --> 00:47.870
Something much more secure would be better.

00:47.900 --> 00:49.330
Its okay to use this.

00:49.340 --> 00:53.680
While we're developing now so let's copy this hash.

00:57.740 --> 01:03.900
And replace the clear text password in our database.

01:06.870 --> 01:08.220
Like that.

01:12.670 --> 01:16.260
Then in the authenticate method in the User class.

01:16.450 --> 01:22.630
Instead of using a simple string comparison to compare the password stood in the database with the password

01:22.720 --> 01:30.650
argument will use the password verify function instead.

01:31.630 --> 01:33.340
Let's give that a try.

01:33.340 --> 01:38.410
First let's try logging in with an incorrect password.

01:40.180 --> 01:44.260
And that fails path indication as expected.

01:44.260 --> 01:48.910
Now if I put in the correct name and password.

01:51.730 --> 01:56.250
We are authenticated successfully and logged in as before.

01:58.920 --> 02:05.700
However now the password has stood as a hash in the database instead of clear text which is much more

02:05.700 --> 02:06.580
secure.