Password hashing with password_hash in PHP - Mini Project: Build & Apply

Password hashing with password_hash

📖 Scenario: You are building a simple user registration system. To keep user passwords safe, you need to convert plain text passwords into secure hashed versions before storing them.

🎯 Goal: Create a PHP script that hashes a given password using the password_hash function with the default algorithm.

📋 What You'll Learn

Create a variable to hold the plain text password.

Create a variable to store the hashed password using password_hash.

Use the default hashing algorithm.

Print the hashed password.

💡 Why This Matters

🌍 Real World

Web applications need to store user passwords securely to protect user accounts from theft or misuse.

💼 Career

Understanding password hashing is essential for backend developers and security engineers to build safe authentication systems.

1

Create a plain text password variable

Create a variable called $password and set it to the string "MySecret123".

PHP

<?php

// Create a variable called $password and set it to "MySecret123"
// Your code here

Hint

Use the = sign to assign the string to the variable.

2

Hash the password using password_hash

Create a variable called $hashedPassword and set it to the result of password_hash called with $password and PASSWORD_DEFAULT as arguments.

PHP

<?php

$password = "MySecret123";

// Create a variable $hashedPassword using password_hash with $password and PASSWORD_DEFAULT
// Your code here

Hint

Use password_hash($password, PASSWORD_DEFAULT) to create the hash.

3

Print the hashed password

Use echo to print the variable $hashedPassword.

PHP

<?php

$password = "MySecret123";
$hashedPassword = password_hash($password, PASSWORD_DEFAULT);

// Print the hashed password using echo
// Your code here

Hint

The output should start with $2y$ which is the prefix for bcrypt hashes in PHP.

4

Complete script to hash and display password

Combine all previous steps into a complete PHP script that sets $password, hashes it into $hashedPassword, and prints the hashed password.

PHP

<?php

$password = "MySecret123";
$hashedPassword = password_hash($password, PASSWORD_DEFAULT);
echo $hashedPassword;

// This is the complete script
// Your code here

Hint

Run the script to see the hashed password printed.

Practice

1. What is the main purpose of the password_hash function in PHP?

easy

A. To store passwords in plain text

B. To verify if a password matches a hash

C. To decrypt a hashed password back to plain text

D. To securely convert a plain password into a hashed string

Solution

1. Step 1: Understand what password_hash does

   This function takes a plain password and creates a secure hashed version that cannot be reversed.

2. Step 2: Compare options with function purpose

   To securely convert a plain password into a hashed string correctly describes hashing. To verify if a password matches a hash is for password_verify. Options A and D are incorrect because passwords should never be stored in plain text or decrypted.

3. Final Answer:

   To securely convert a plain password into a hashed string -> Option D

4. Quick Check:

   password_hash = create secure hash [OK]

Hint: Hash means secure one-way password conversion [OK]

Common Mistakes:

• Confusing hashing with verifying passwords
• Thinking passwords can be decrypted
• Storing passwords as plain text

2. Which of the following is the correct syntax to hash a password using password_hash with the default algorithm?

easy

A. $hash = password_hash($password, PASSWORD_DEFAULT);

B. $hash = password_hash($password, 'default');

C. $hash = password_hash($password, default);

D. $hash = password_hash(PASSWORD_DEFAULT, $password);

Solution

1. Step 1: Recall the correct function signature

   The password_hash function requires the password string and the algorithm constant, e.g., PASSWORD_DEFAULT.

2. Step 2: Check each option's syntax

   $hash = password_hash($password, PASSWORD_DEFAULT); correctly passes the password variable and the constant. $hash = password_hash($password, 'default'); uses a string instead of constant. $hash = password_hash($password, default); uses undefined constant "default". $hash = password_hash(PASSWORD_DEFAULT, $password); swaps arguments incorrectly.

3. Final Answer:

   $hash = password_hash($password, PASSWORD_DEFAULT); -> Option A

4. Quick Check:

   password_hash(password, algorithm) correct syntax [OK]

Hint: Always pass password then algorithm constant [OK]

Common Mistakes:

• Using string 'default' instead of PASSWORD_DEFAULT
• Omitting the algorithm parameter
• Swapping argument order

3. What will be the output of the following PHP code?

$password = 'mypassword';
$hash = password_hash($password, PASSWORD_DEFAULT);
echo password_verify('mypassword', $hash) ? 'Valid' : 'Invalid';

medium

A. Invalid

B. Valid

C. Error: Undefined function

D. Empty output

Solution

1. Step 1: Understand password_hash and password_verify usage

   The code hashes 'mypassword' and then verifies the same password against the hash.

2. Step 2: Evaluate the verification result

   Since the password matches the hash, password_verify returns true, so 'Valid' is printed.

3. Final Answer:

   Valid -> Option B

4. Quick Check:

   password_verify correct password = true [OK]

Hint: Verify with same password returns true [OK]

Common Mistakes:

• Expecting hash to be plain text
• Confusing verify with hash
• Assuming password_verify returns the hash

4. Identify the error in this PHP code snippet:

$password = 'secret';
$hash = password_hash($password);
if (password_verify($hash, $password)) {
    echo 'Access granted';
} else {
    echo 'Access denied';
}

medium

A. Variable $password is undefined

B. Echo statements are incorrect

C. password_verify arguments are reversed

D. Missing algorithm parameter in password_hash

Solution

1. Step 1: Check password_verify function call

   The password_verify function takes the plain password as first argument and the hash as second. In the code, the arguments are reversed: hash first, then password.

2. Step 2: Verify other parts of the code

   The password_hash call is correct (uses PASSWORD_DEFAULT by default), $password is defined, echo statements are fine.

3. Final Answer:

   password_verify arguments are reversed -> Option C

4. Quick Check:

   password_verify(plain_password, hash) [OK]

Hint: password_verify(plain, hash) order [OK]

Common Mistakes:

• Forgetting the algorithm argument
• Swapping arguments in password_verify
• Assuming password_hash works with one argument

5. You want to store user passwords securely and later verify them during login. Which of the following code snippets correctly implements this using password_hash and password_verify?

hard

A. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $hash in database

// Later during login
if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

B. $hash = password_hash($userPassword);
// Store $hash

if (password_verify($hash, $inputPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

C. $hash = md5($userPassword);
// Store $hash

if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

D. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $userPassword

if (password_verify($inputPassword, $userPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

Solution

1. Step 1: Check correct usage of password_hash and password_verify

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $hash in database
   
   // Later during login
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   hashes the password with PASSWORD_DEFAULT and stores the hash. Later, it verifies the input password against the stored hash correctly.

2. Step 2: Identify errors in other options

   $hash = password_hash($userPassword);
   // Store $hash
   
   if (password_verify($hash, $inputPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   misses the algorithm and reverses arguments in password_verify.

   $hash = md5($userPassword);
   // Store $hash
   
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   uses insecure md5 instead of password_hash.

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $userPassword
   
   if (password_verify($inputPassword, $userPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   stores plain password and verifies incorrectly.

3. Final Answer:

   Option A correctly hashes and verifies passwords securely -> Option A

4. Quick Check:

   Hash with password_hash, verify with password_verify [OK]

Hint: Hash with PASSWORD_DEFAULT, verify with password_verify [OK]

Common Mistakes:

• Using md5 instead of password_hash
• Swapping arguments in password_verify
• Storing plain passwords instead of hashes