Password hashing with password_hash in PHP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to hash the password using password_hash.

PHP

<?php
$password = 'mypassword';
$hash = password_hash($password, [1]);
echo $hash;
?>

Drag options to blanks, or click blank then click option'

APASSWORD_BCRYPT

BPASSWORD_MD5

CPASSWORD_SHA256

DPASSWORD_PLAIN

Attempts:

3 left

💡 Hint

Common Mistakes

Using unsupported constants like PASSWORD_MD5 or PASSWORD_SHA256.

Passing the password string instead of the algorithm constant.

The password_hash function uses PASSWORD_BCRYPT to create a secure hash.

2fill in blank

medium

Complete the code to verify the password against the hash.

PHP

<?php
$password = 'mypassword';
$hash = password_hash($password, PASSWORD_BCRYPT);
if (password_verify($password, [1])) {
    echo 'Password is valid';
} else {
    echo 'Invalid password';
}
?>

Drag options to blanks, or click blank then click option'

A$password

B$hash

C'mypassword'

DPASSWORD_BCRYPT

Attempts:

3 left

💡 Hint

Common Mistakes

Passing the plain password instead of the hash as the second argument.

Passing the algorithm constant instead of the hash.

The password_verify function compares the plain password with the stored hash, so the second argument must be the hash variable.

3fill in blank

hard

Fix the error in the code to correctly hash the password.

PHP

<?php
$password = 'secret';
$hash = password_hash([1], PASSWORD_BCRYPT);
echo $hash;
?>

Drag options to blanks, or click blank then click option'

Apassword

B'password'

C$hash

D$password

Attempts:

3 left

💡 Hint

Common Mistakes

Passing the string 'password' instead of the variable.

Passing an undefined variable or the hash variable itself.

The variable $password must be passed to password_hash to hash the actual password string.

4fill in blank

hard

Fill both blanks to create a dictionary of usernames and their hashed passwords, only for users with passwords longer than 6 characters.

PHP

<?php
$users = ['alice' => 'secret123', 'bob' => '123', 'carol' => 'mypassword'];
$hashedUsers = array_filter(array_map(function($password) {
    return password_hash($password, [1]);
}, $users), function($password, $username) use ($users) {
    return strlen($users[$username]) > 6;
});
print_r($hashedUsers);
?>

Drag options to blanks, or click blank then click option'

APASSWORD_BCRYPT

B'alice'

C'bob'

D'carol'

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong constants for hashing.

Checking password length for a user with a short password.

Use PASSWORD_BCRYPT for hashing. The filter checks password length for user 'carol' whose password is longer than 6 characters.

5fill in blank

hard

Fill all three blanks to create a filtered array of usernames and hashed passwords where the password length is greater than 5 and the username starts with 'a'.

PHP

<?php
$users = ['alice' => 'secret123', 'bob' => '123456', 'anna' => 'mypassword'];
$filteredHashed = array_filter(array_map(function($user, $password) {
    return [$user => password_hash($password, [1])];
}, array_keys($users), $users), function($user, $password) {
    return strlen($password) [2] 5 && str_starts_with($user, [3]);
}, ARRAY_FILTER_USE_BOTH);
print_r($filteredHashed);
?>

Drag options to blanks, or click blank then click option'

APASSWORD_BCRYPT

B>

C'a'

D<

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong comparison operators.

Not quoting the letter 'a' in the string check.

Using wrong hashing algorithm constants.

Use PASSWORD_BCRYPT for hashing, check if password length is greater than 5, and filter usernames starting with 'a'.

Practice

1. What is the main purpose of the password_hash function in PHP?

easy

A. To store passwords in plain text

B. To verify if a password matches a hash

C. To decrypt a hashed password back to plain text

D. To securely convert a plain password into a hashed string

Solution

1. Step 1: Understand what password_hash does

   This function takes a plain password and creates a secure hashed version that cannot be reversed.

2. Step 2: Compare options with function purpose

   To securely convert a plain password into a hashed string correctly describes hashing. To verify if a password matches a hash is for password_verify. Options A and D are incorrect because passwords should never be stored in plain text or decrypted.

3. Final Answer:

   To securely convert a plain password into a hashed string -> Option D

4. Quick Check:

   password_hash = create secure hash [OK]

Hint: Hash means secure one-way password conversion [OK]

Common Mistakes:

• Confusing hashing with verifying passwords
• Thinking passwords can be decrypted
• Storing passwords as plain text

2. Which of the following is the correct syntax to hash a password using password_hash with the default algorithm?

easy

A. $hash = password_hash($password, PASSWORD_DEFAULT);

B. $hash = password_hash($password, 'default');

C. $hash = password_hash($password, default);

D. $hash = password_hash(PASSWORD_DEFAULT, $password);

Solution

1. Step 1: Recall the correct function signature

   The password_hash function requires the password string and the algorithm constant, e.g., PASSWORD_DEFAULT.

2. Step 2: Check each option's syntax

   $hash = password_hash($password, PASSWORD_DEFAULT); correctly passes the password variable and the constant. $hash = password_hash($password, 'default'); uses a string instead of constant. $hash = password_hash($password, default); uses undefined constant "default". $hash = password_hash(PASSWORD_DEFAULT, $password); swaps arguments incorrectly.

3. Final Answer:

   $hash = password_hash($password, PASSWORD_DEFAULT); -> Option A

4. Quick Check:

   password_hash(password, algorithm) correct syntax [OK]

Hint: Always pass password then algorithm constant [OK]

Common Mistakes:

• Using string 'default' instead of PASSWORD_DEFAULT
• Omitting the algorithm parameter
• Swapping argument order

3. What will be the output of the following PHP code?

$password = 'mypassword';
$hash = password_hash($password, PASSWORD_DEFAULT);
echo password_verify('mypassword', $hash) ? 'Valid' : 'Invalid';

medium

A. Invalid

B. Valid

C. Error: Undefined function

D. Empty output

Solution

1. Step 1: Understand password_hash and password_verify usage

   The code hashes 'mypassword' and then verifies the same password against the hash.

2. Step 2: Evaluate the verification result

   Since the password matches the hash, password_verify returns true, so 'Valid' is printed.

3. Final Answer:

   Valid -> Option B

4. Quick Check:

   password_verify correct password = true [OK]

Hint: Verify with same password returns true [OK]

Common Mistakes:

• Expecting hash to be plain text
• Confusing verify with hash
• Assuming password_verify returns the hash

4. Identify the error in this PHP code snippet:

$password = 'secret';
$hash = password_hash($password);
if (password_verify($hash, $password)) {
    echo 'Access granted';
} else {
    echo 'Access denied';
}

medium

A. Variable $password is undefined

B. Echo statements are incorrect

C. password_verify arguments are reversed

D. Missing algorithm parameter in password_hash

Solution

1. Step 1: Check password_verify function call

   The password_verify function takes the plain password as first argument and the hash as second. In the code, the arguments are reversed: hash first, then password.

2. Step 2: Verify other parts of the code

   The password_hash call is correct (uses PASSWORD_DEFAULT by default), $password is defined, echo statements are fine.

3. Final Answer:

   password_verify arguments are reversed -> Option C

4. Quick Check:

   password_verify(plain_password, hash) [OK]

Hint: password_verify(plain, hash) order [OK]

Common Mistakes:

• Forgetting the algorithm argument
• Swapping arguments in password_verify
• Assuming password_hash works with one argument

5. You want to store user passwords securely and later verify them during login. Which of the following code snippets correctly implements this using password_hash and password_verify?

hard

A. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $hash in database

// Later during login
if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

B. $hash = password_hash($userPassword);
// Store $hash

if (password_verify($hash, $inputPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

C. $hash = md5($userPassword);
// Store $hash

if (password_verify($inputPassword, $hash)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

D. $hash = password_hash($userPassword, PASSWORD_DEFAULT);
// Store $userPassword

if (password_verify($inputPassword, $userPassword)) {
echo 'Login successful';
} else {
echo 'Login failed';
}

Solution

1. Step 1: Check correct usage of password_hash and password_verify

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $hash in database
   
   // Later during login
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   hashes the password with PASSWORD_DEFAULT and stores the hash. Later, it verifies the input password against the stored hash correctly.

2. Step 2: Identify errors in other options

   $hash = password_hash($userPassword);
   // Store $hash
   
   if (password_verify($hash, $inputPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   misses the algorithm and reverses arguments in password_verify.

   $hash = md5($userPassword);
   // Store $hash
   
   if (password_verify($inputPassword, $hash)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   uses insecure md5 instead of password_hash.

   $hash = password_hash($userPassword, PASSWORD_DEFAULT);
   // Store $userPassword
   
   if (password_verify($inputPassword, $userPassword)) {
       echo 'Login successful';
   } else {
       echo 'Login failed';
   }

   stores plain password and verifies incorrectly.

3. Final Answer:

   Option A correctly hashes and verifies passwords securely -> Option A

4. Quick Check:

   Hash with password_hash, verify with password_verify [OK]

Hint: Hash with PASSWORD_DEFAULT, verify with password_verify [OK]

Common Mistakes:

• Using md5 instead of password_hash
• Swapping arguments in password_verify
• Storing plain passwords instead of hashes