Password hashing with password_hash in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this password verification code?

Consider the following PHP code that hashes a password and then verifies it. What will be the output?

PHP

<?php
$password = 'secret123';
$hash = password_hash($password, PASSWORD_DEFAULT);
if (password_verify('secret123', $hash)) {
    echo 'Access granted';
} else {
    echo 'Access denied';
}
?>

A Error: Undefined function password_hash

B Access denied

C Access grantedAccess denied

D Access granted

💡 Hint

Think about what password_hash and password_verify do together.

The password_hash function creates a secure hash of the password. The password_verify function checks if the given password matches the hash. Since the password matches, it prints 'Access granted'.

🧠 Conceptual

intermediate

What does PASSWORD_DEFAULT mean in password_hash?

In PHP's password_hash function, what does the constant PASSWORD_DEFAULT represent?

A It always uses the MD5 hashing algorithm.

B It disables hashing and stores the password as plain text.

C It uses the strongest available algorithm currently recommended by PHP.

D It uses a custom user-defined hashing algorithm.

💡 Hint

Think about why PHP would choose a default algorithm.

PASSWORD_DEFAULT tells PHP to use the best available hashing algorithm at the time, which can change as better algorithms become available. It ensures your code stays secure without manual updates.

🔧 Debug

advanced

Why does this password verification always fail?

Look at this PHP code snippet. It tries to verify a password but always prints 'Access denied'. What is the problem?

PHP

<?php
$password = 'mypassword';
$hash = password_hash($password, PASSWORD_DEFAULT);
if (password_verify($password, '$hash')) {
    echo 'Access granted';
} else {
    echo 'Access denied';
}
?>

A The hash is passed as a string literal instead of the variable, so verification fails.

B password_hash does not generate a valid hash for password_verify.

C password_verify requires the password first, then the hash, but the order is reversed here.

D The password variable is empty, so verification fails.

💡 Hint

Check how the hash variable is used inside password_verify.

The hash is passed as a string literal '$hash' instead of the variable $hash. This means password_verify compares the password to the string '$hash', which is not the actual hash, so it fails.

📝 Syntax

advanced

Which option correctly hashes and verifies a password?

Which of the following PHP code snippets correctly hashes a password and verifies it?

A

<?php
$pass = 'abc123';
$hash = password_hash($pass, PASSWORD_DEFAULT);
if(password_verify($pass, $hash)) echo 'OK';
?>

B

<?php
$pass = 'abc123';
$hash = password_hash($pass PASSWORD_DEFAULT);
if(password_verify($pass, $hash)) echo 'OK';
?>

C

<?php
$pass = 'abc123';
$hash = password_hash($pass, PASSWORD_DEFAULT)
if(password_verify($pass, $hash)) echo 'OK';
?>

D

<?php
$pass = 'abc123';
$hash = password_hash($pass, PASSWORD_DEFAULT);
if(password_verify($hash, $pass)) echo 'OK';
?>

💡 Hint

Look carefully for missing commas, semicolons, and argument order.

Option A is correct: it uses a comma between arguments, has semicolons, and calls password_verify with password first, then hash. Others have syntax errors or wrong argument order.

🚀 Application

expert

How many items are in the array after this password hash update?

This PHP code stores user passwords hashed. It then updates the hash if the algorithm changes. How many items will be in the $users array after running this code?

PHP

<?php
$users = [
    ['username' => 'alice', 'hash' => password_hash('pass1', PASSWORD_DEFAULT)],
    ['username' => 'bob', 'hash' => password_hash('pass2', PASSWORD_DEFAULT)]
];

foreach ($users as &$user) {
    if (password_needs_rehash($user['hash'], PASSWORD_DEFAULT)) {
        $user['hash'] = password_hash('pass' . substr($user['username'], 0, 1), PASSWORD_DEFAULT);
    }
}

// How many items in $users?

A 0

B 2

C 1

D Depends on the PHP version

💡 Hint

Think about whether the array changes size during the loop.

The code updates hashes in place but does not add or remove users. The array still has 2 items after the loop.