Password hashing with password_hash in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the password_hash function in PHP?

The password_hash function creates a secure hash of a password. It helps protect passwords by converting them into a form that is hard to reverse or guess.

beginner

Which algorithm does password_hash use by default?

By default, password_hash uses the BCRYPT algorithm, which is strong and includes a salt automatically.

intermediate

Why is it important that password_hash automatically adds a salt?

Adding a salt means a unique random value is mixed into the password before hashing. This stops attackers from using pre-made tables to guess passwords and makes each hash unique.

beginner

How do you verify a password against a hash created by password_hash?

Use the password_verify function. It takes the plain password and the stored hash, then checks if they match securely.

intermediate

What is the benefit of using password_hash over simple hashing functions like md5 or sha1?

Simple hashes like md5 or sha1 are fast and lack salts, making them vulnerable to attacks. password_hash is slower and adds salts, making password storage much safer.

What does the password_hash function return?

A A boolean true or false

B The original password

C A hashed string of the password

D An encrypted password file

password_hash returns a hashed string that represents the password securely.

Which PHP function should you use to check if a password matches a hash?

A password_verify()

B password_check()

C hash_equals()

D password_compare()

password_verify() is the correct function to verify a password against a hash.

Why is it unsafe to use md5 for password hashing?

A It is too slow

B It automatically salts passwords

C It uses too much memory

D It is fast and unsalted, making it vulnerable to attacks

md5 is fast and does not add a salt, so attackers can guess passwords easily.

What does the salt in password hashing do?

A Makes the password longer

B Adds a unique random value to the password before hashing

C Encrypts the password

D Removes special characters from the password

Salt adds a unique random value to each password before hashing to make hashes unique.

Which algorithm is used by default in password_hash?

A BCRYPT

B MD5

C SHA256

D AES

The default algorithm for password_hash is BCRYPT.

Explain how password_hash helps keep passwords safe.

Think about what makes a password hard to guess or reverse.

Describe the steps to securely check a user's password using PHP functions.

Consider how you store and then check the password.