Password hashing with password_hash in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the password_hash function in PHP?

The password_hash function creates a secure hash of a password. It helps protect passwords by converting them into a form that is hard to reverse or guess.

beginner

Which algorithm does password_hash use by default?

By default, password_hash uses the BCRYPT algorithm, which is strong and includes a salt automatically.

intermediate

Why is it important that password_hash automatically adds a salt?

Adding a salt means a unique random value is mixed into the password before hashing. This stops attackers from using pre-made tables to guess passwords and makes each hash unique.

beginner

How do you verify a password against a hash created by password_hash?

Use the password_verify function. It takes the plain password and the stored hash, then checks if they match securely.

intermediate

What is the benefit of using password_hash over simple hashing functions like md5 or sha1?

Simple hashes like md5 or sha1 are fast and lack salts, making them vulnerable to attacks. password_hash is slower and adds salts, making password storage much safer.

What does the password_hash function return?

A A boolean true or false

B The original password

C A hashed string of the password

D An encrypted password file

password_hash returns a hashed string that represents the password securely.

Which PHP function should you use to check if a password matches a hash?

A password_verify()

B password_check()

C hash_equals()

D password_compare()

password_verify() is the correct function to verify a password against a hash.

Why is it unsafe to use md5 for password hashing?

A It is too slow

B It automatically salts passwords

C It uses too much memory

D It is fast and unsalted, making it vulnerable to attacks

md5 is fast and does not add a salt, so attackers can guess passwords easily.

What does the salt in password hashing do?

A Makes the password longer

B Adds a unique random value to the password before hashing

C Encrypts the password

D Removes special characters from the password

Salt adds a unique random value to each password before hashing to make hashes unique.

Which algorithm is used by default in password_hash?

A BCRYPT

B MD5

C SHA256

D AES

The default algorithm for password_hash is BCRYPT.

Explain how password_hash helps keep passwords safe.

Think about what makes a password hard to guess or reverse.

Describe the steps to securely check a user's password using PHP functions.

Consider how you store and then check the password.

Practice

1. What is the main purpose of the password_hash function in PHP?

easy

A. To store passwords in plain text

B. To verify if a password matches a hash

C. To decrypt a hashed password back to plain text

D. To securely convert a plain password into a hashed string

Solution

1. Step 1: Understand what password_hash does

   This function takes a plain password and creates a secure hashed version that cannot be reversed.

2. Step 2: Compare options with function purpose

   To securely convert a plain password into a hashed string correctly describes hashing. To verify if a password matches a hash is for password_verify. Options A and D are incorrect because passwords should never be stored in plain text or decrypted.

3. Final Answer:

   To securely convert a plain password into a hashed string -> Option D

4. Quick Check:

   password_hash = create secure hash [OK]

Hint: Hash means secure one-way password conversion [OK]

Common Mistakes:

• Confusing hashing with verifying passwords
• Thinking passwords can be decrypted
• Storing passwords as plain text

2. Which of the following is the correct syntax to hash a password using password_hash with the default algorithm?

easy

A. $hash = password_hash($password, PASSWORD_DEFAULT);

B. $hash = password_hash($password, 'default');

C. $hash = password_hash($password, default);

D. $hash = password_hash(PASSWORD_DEFAULT, $password);

Solution

1. Step 1: Recall the correct function signature

   The password_hash function requires the password string and the algorithm constant, e.g., PASSWORD_DEFAULT.

2. Step 2: Check each option's syntax

   $hash = password_hash($password, PASSWORD_DEFAULT); correctly passes the password variable and the constant. $hash = password_hash($password, 'default'); uses a string instead of constant. $hash = password_hash($password, default); uses undefined constant "default". $hash = password_hash(PASSWORD_DEFAULT, $password); swaps arguments incorrectly.

3. Final Answer:

   $hash = password_hash($password, PASSWORD_DEFAULT); -> Option A

4. Quick Check:

   password_hash(password, algorithm) correct syntax [OK]

Hint: Always pass password then algorithm constant [OK]

Common Mistakes:

• Using string 'default' instead of PASSWORD_DEFAULT
• Omitting the algorithm parameter
• Swapping argument order

3. What will be the output of the following PHP code?

$password = 'mypassword';
$hash = password_hash($password, PASSWORD_DEFAULT);
echo password_verify('mypassword', $hash) ? 'Valid' : 'Invalid';

medium

A. Invalid

B. Valid

C. Error: Undefined function

D. Empty output

Solution

1. Step 1: Understand password_hash and password_verify usage

   The code hashes 'mypassword' and then verifies the same password against the hash.

2. Step 2: Evaluate the verification result

   Since the password matches the hash, password_verify returns true, so 'Valid' is printed.

3. Final Answer:

   Valid -> Option B

4. Quick Check:

   password_verify correct password = true [OK]

Hint: Verify with same password returns true [OK]

Common Mistakes:

• Expecting hash to be plain text
• Confusing verify with hash
• Assuming password_verify returns the hash

4. Identify the error in this PHP code snippet:

$password = 'secret';
$hash = password_hash($password);
if (password_verify($hash, $password)) {
    echo 'Access granted';
} else {
    echo 'Access denied';
}

medium

A. Variable $password is undefined

B. Echo statements are incorrect

C. password_verify arguments are reversed

D. Missing algorithm parameter in password_hash

Solution

1. Step 1: Check password_verify function call

   The password_verify function takes the plain password as first argument and the hash as second. In the code, the arguments are reversed: hash first, then password.

2. Step 2: Verify other parts of the code

   The password_hash call is correct (uses PASSWORD_DEFAULT by default), $password is defined, echo statements are fine.

3. Final Answer:

   password_verify arguments are reversed -> Option C

4. Quick Check:

   password_verify(plain_password, hash) [OK]

Hint: password_verify(plain, hash) order [OK]

Common Mistakes:

• Forgetting the algorithm argument
• Swapping arguments in password_verify
• Assuming password_hash works with one argument

5. You want to store user passwords securely and later verify them during login. Which of the following code snippets correctly implements this using password_hash and password_verify?

hard

A. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $hash in database

// Later during login
if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

B. $hash = password_hash($userPassword);
// Store $hash

if (password_verify($hash, $inputPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

C. $hash = md5($userPassword);
// Store $hash

if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

D. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $userPassword

if (password_verify($inputPassword, $userPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

Solution

1. Step 1: Check correct usage of password_hash and password_verify

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $hash in database
   
   // Later during login
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   hashes the password with PASSWORD_DEFAULT and stores the hash. Later, it verifies the input password against the stored hash correctly.

2. Step 2: Identify errors in other options

   $hash = password_hash($userPassword);
   // Store $hash
   
   if (password_verify($hash, $inputPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   misses the algorithm and reverses arguments in password_verify.

   $hash = md5($userPassword);
   // Store $hash
   
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   uses insecure md5 instead of password_hash.

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $userPassword
   
   if (password_verify($inputPassword, $userPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   stores plain password and verifies incorrectly.

3. Final Answer:

   Option A correctly hashes and verifies passwords securely -> Option A

4. Quick Check:

   Hash with password_hash, verify with password_verify [OK]

Hint: Hash with PASSWORD_DEFAULT, verify with password_verify [OK]

Common Mistakes:

• Using md5 instead of password_hash
• Swapping arguments in password_verify
• Storing plain passwords instead of hashes