Password hashing with password_hash in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this password verification code?

Consider the following PHP code that hashes a password and then verifies it. What will be the output?

PHP

<?php
$password = 'secret123';
$hash = password_hash($password, PASSWORD_DEFAULT);
if (password_verify('secret123', $hash)) {
    echo 'Access granted';
} else {
    echo 'Access denied';
}
?>

A Error: Undefined function password_hash

B Access denied

C Access grantedAccess denied

D Access granted

💡 Hint

Think about what password_hash and password_verify do together.

The password_hash function creates a secure hash of the password. The password_verify function checks if the given password matches the hash. Since the password matches, it prints 'Access granted'.

🧠 Conceptual

intermediate

What does PASSWORD_DEFAULT mean in password_hash?

In PHP's password_hash function, what does the constant PASSWORD_DEFAULT represent?

A It always uses the MD5 hashing algorithm.

B It disables hashing and stores the password as plain text.

C It uses the strongest available algorithm currently recommended by PHP.

D It uses a custom user-defined hashing algorithm.

💡 Hint

Think about why PHP would choose a default algorithm.

PASSWORD_DEFAULT tells PHP to use the best available hashing algorithm at the time, which can change as better algorithms become available. It ensures your code stays secure without manual updates.

🔧 Debug

advanced

Why does this password verification always fail?

Look at this PHP code snippet. It tries to verify a password but always prints 'Access denied'. What is the problem?

PHP

<?php
$password = 'mypassword';
$hash = password_hash($password, PASSWORD_DEFAULT);
if (password_verify($password, '$hash')) {
    echo 'Access granted';
} else {
    echo 'Access denied';
}
?>

A The hash is passed as a string literal instead of the variable, so verification fails.

B password_hash does not generate a valid hash for password_verify.

C password_verify requires the password first, then the hash, but the order is reversed here.

D The password variable is empty, so verification fails.

💡 Hint

Check how the hash variable is used inside password_verify.

The hash is passed as a string literal '$hash' instead of the variable $hash. This means password_verify compares the password to the string '$hash', which is not the actual hash, so it fails.

📝 Syntax

advanced

Which option correctly hashes and verifies a password?

Which of the following PHP code snippets correctly hashes a password and verifies it?

A

<?php
$pass = 'abc123';
$hash = password_hash($pass, PASSWORD_DEFAULT);
if(password_verify($pass, $hash)) echo 'OK';
?>

B

<?php
$pass = 'abc123';
$hash = password_hash($pass PASSWORD_DEFAULT);
if(password_verify($pass, $hash)) echo 'OK';
?>

C

<?php
$pass = 'abc123';
$hash = password_hash($pass, PASSWORD_DEFAULT)
if(password_verify($pass, $hash)) echo 'OK';
?>

D

<?php
$pass = 'abc123';
$hash = password_hash($pass, PASSWORD_DEFAULT);
if(password_verify($hash, $pass)) echo 'OK';
?>

💡 Hint

Look carefully for missing commas, semicolons, and argument order.

Option A is correct: it uses a comma between arguments, has semicolons, and calls password_verify with password first, then hash. Others have syntax errors or wrong argument order.

🚀 Application

expert

How many items are in the array after this password hash update?

This PHP code stores user passwords hashed. It then updates the hash if the algorithm changes. How many items will be in the $users array after running this code?

PHP

<?php
$users = [
    ['username' => 'alice', 'hash' => password_hash('pass1', PASSWORD_DEFAULT)],
    ['username' => 'bob', 'hash' => password_hash('pass2', PASSWORD_DEFAULT)]
];

foreach ($users as &$user) {
    if (password_needs_rehash($user['hash'], PASSWORD_DEFAULT)) {
        $user['hash'] = password_hash('pass' . substr($user['username'], 0, 1), PASSWORD_DEFAULT);
    }
}

// How many items in $users?

A 0

B 2

C 1

D Depends on the PHP version

💡 Hint

Think about whether the array changes size during the loop.

The code updates hashes in place but does not add or remove users. The array still has 2 items after the loop.

Practice

1. What is the main purpose of the password_hash function in PHP?

easy

A. To store passwords in plain text

B. To verify if a password matches a hash

C. To decrypt a hashed password back to plain text

D. To securely convert a plain password into a hashed string

Solution

1. Step 1: Understand what password_hash does

   This function takes a plain password and creates a secure hashed version that cannot be reversed.

2. Step 2: Compare options with function purpose

   To securely convert a plain password into a hashed string correctly describes hashing. To verify if a password matches a hash is for password_verify. Options A and D are incorrect because passwords should never be stored in plain text or decrypted.

3. Final Answer:

   To securely convert a plain password into a hashed string -> Option D

4. Quick Check:

   password_hash = create secure hash [OK]

Hint: Hash means secure one-way password conversion [OK]

Common Mistakes:

• Confusing hashing with verifying passwords
• Thinking passwords can be decrypted
• Storing passwords as plain text

2. Which of the following is the correct syntax to hash a password using password_hash with the default algorithm?

easy

A. $hash = password_hash($password, PASSWORD_DEFAULT);

B. $hash = password_hash($password, 'default');

C. $hash = password_hash($password, default);

D. $hash = password_hash(PASSWORD_DEFAULT, $password);

Solution

1. Step 1: Recall the correct function signature

   The password_hash function requires the password string and the algorithm constant, e.g., PASSWORD_DEFAULT.

2. Step 2: Check each option's syntax

   $hash = password_hash($password, PASSWORD_DEFAULT); correctly passes the password variable and the constant. $hash = password_hash($password, 'default'); uses a string instead of constant. $hash = password_hash($password, default); uses undefined constant "default". $hash = password_hash(PASSWORD_DEFAULT, $password); swaps arguments incorrectly.

3. Final Answer:

   $hash = password_hash($password, PASSWORD_DEFAULT); -> Option A

4. Quick Check:

   password_hash(password, algorithm) correct syntax [OK]

Hint: Always pass password then algorithm constant [OK]

Common Mistakes:

• Using string 'default' instead of PASSWORD_DEFAULT
• Omitting the algorithm parameter
• Swapping argument order

3. What will be the output of the following PHP code?

$password = 'mypassword';
$hash = password_hash($password, PASSWORD_DEFAULT);
echo password_verify('mypassword', $hash) ? 'Valid' : 'Invalid';

medium

A. Invalid

B. Valid

C. Error: Undefined function

D. Empty output

Solution

1. Step 1: Understand password_hash and password_verify usage

   The code hashes 'mypassword' and then verifies the same password against the hash.

2. Step 2: Evaluate the verification result

   Since the password matches the hash, password_verify returns true, so 'Valid' is printed.

3. Final Answer:

   Valid -> Option B

4. Quick Check:

   password_verify correct password = true [OK]

Hint: Verify with same password returns true [OK]

Common Mistakes:

• Expecting hash to be plain text
• Confusing verify with hash
• Assuming password_verify returns the hash

4. Identify the error in this PHP code snippet:

$password = 'secret';
$hash = password_hash($password);
if (password_verify($hash, $password)) {
    echo 'Access granted';
} else {
    echo 'Access denied';
}

medium

A. Variable $password is undefined

B. Echo statements are incorrect

C. password_verify arguments are reversed

D. Missing algorithm parameter in password_hash

Solution

1. Step 1: Check password_verify function call

   The password_verify function takes the plain password as first argument and the hash as second. In the code, the arguments are reversed: hash first, then password.

2. Step 2: Verify other parts of the code

   The password_hash call is correct (uses PASSWORD_DEFAULT by default), $password is defined, echo statements are fine.

3. Final Answer:

   password_verify arguments are reversed -> Option C

4. Quick Check:

   password_verify(plain_password, hash) [OK]

Hint: password_verify(plain, hash) order [OK]

Common Mistakes:

• Forgetting the algorithm argument
• Swapping arguments in password_verify
• Assuming password_hash works with one argument

5. You want to store user passwords securely and later verify them during login. Which of the following code snippets correctly implements this using password_hash and password_verify?

hard

A. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $hash in database

// Later during login
if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

B. $hash = password_hash($userPassword);
// Store $hash

if (password_verify($hash, $inputPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

C. $hash = md5($userPassword);
// Store $hash

if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

D. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $userPassword

if (password_verify($inputPassword, $userPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

Solution

1. Step 1: Check correct usage of password_hash and password_verify

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $hash in database
   
   // Later during login
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   hashes the password with PASSWORD_DEFAULT and stores the hash. Later, it verifies the input password against the stored hash correctly.

2. Step 2: Identify errors in other options

   $hash = password_hash($userPassword);
   // Store $hash
   
   if (password_verify($hash, $inputPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   misses the algorithm and reverses arguments in password_verify.

   $hash = md5($userPassword);
   // Store $hash
   
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   uses insecure md5 instead of password_hash.

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $userPassword
   
   if (password_verify($inputPassword, $userPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   stores plain password and verifies incorrectly.

3. Final Answer:

   Option A correctly hashes and verifies passwords securely -> Option A

4. Quick Check:

   Hash with password_hash, verify with password_verify [OK]

Hint: Hash with PASSWORD_DEFAULT, verify with password_verify [OK]

Common Mistakes:

• Using md5 instead of password_hash
• Swapping arguments in password_verify
• Storing plain passwords instead of hashes