How to Secure hash and salt for PHP passwords ? - GeeksforGeeks

24 Oct, 2019
Salting and hashing is a technique to store the password in a database. In cryptography, salting means to add some content along with the password and then hashing it. So salt and hash provide two levels of security. Salting always makes unique passwords i.e if there are two same passwords, after salting, the resulting string will change. Salting used along with hashing increases the level of security of the passwords.
Salting and hashing: In PHP, storing the password by salting and hashing is done by the password_hash() method. This method takes three parameters and returns a final hash of that password.
Syntax:
string password_hash( string $pass, int $algo, array $options )
Parameters:
$pass: This parameter holds the password that is to be secured and stored in database.
$algo: It specifies the hashing algorithm that is used to create the hash of $pass. Some of the algorithm parameters in php are:PASSWORD_DEFAULT: Use the bcrypt algorithm (default as of PHP 5.5.0). This constant is designed to change over time as new and stronger algorithms are added to PHP.PASSWORD_BCRYPT: It is the CRYPT_BLOWFISH algorithm to create the hash. The result in a 60 character string or give a FALSE on failure.
PASSWORD_DEFAULT: Use the bcrypt algorithm (default as of PHP 5.5.0). This constant is designed to change over time as new and stronger algorithms are added to PHP.PASSWORD_BCRYPT: It is the CRYPT_BLOWFISH algorithm to create the hash. The result in a 60 character string or give a FALSE on failure.
PASSWORD_DEFAULT: Use the bcrypt algorithm (default as of PHP 5.5.0). This constant is designed to change over time as new and stronger algorithms are added to PHP.
PASSWORD_BCRYPT: It is the CRYPT_BLOWFISH algorithm to create the hash. The result in a 60 character string or give a FALSE on failure.
$options: It is the salting part. It takes salt in form cost factor. It is optional, if left empty, default cost is added to the string (It is 10 in most cases). Note that more cost leads to a more protective password and thus puts heavy load on CPU.
Return Value: It returns the hashed password and FALSE on failure.
Example: This example is a demonstration of showing the password_hash(), making of hash and comparing it.
<?php  // Store the string into variable$password = 'Password';  // Use password_hash() function to// create a password hash$hash_default_salt = password_hash($password,                            PASSWORD_DEFAULT);  $hash_variable_salt = password_hash($password,        PASSWORD_DEFAULT, array('cost' => 9));  // Use password_verify() function to// verify the password matchesecho password_verify('Password',            $hash_default_salt ) . "<br>";  echo password_verify('Password',            $hash_variable_salt ) . "<br>";  echo password_verify('Password123',            $hash_default_salt );  ?>
Output:
1
1
0

In this example, the password_verify() method is used to compare the hash created with the string entered as a parameter. It takes the hash and the string to be compared as parameters and return true if the password is correct else it returns false.
PHP-basics
Picked
PHP
PHP Programs
Web Technologies
Web technologies Questions
PHP
Writing code in comment?
Please use ide.geeksforgeeks.org,
generate link and share the link here.
Comments
Old Comments
How to Insert Form Data into Database using PHP ?
How to execute PHP code using command line ?
How to pop an alert message box using PHP ?
PHP in_array() Function
How to convert array to string in PHP ?
How to Insert Form Data into Database using PHP ?
How to execute PHP code using command line ?
How to pop an alert message box using PHP ?
How to convert array to string in PHP ?
How to delete an array element based on key in PHP?