How to hash and verify passwords using PHP's password_hash function

Question

Lately I have been trying to implement my own security on a login script I found on the internet. While trying to learn a script on how to generate a salt for each user, I stumbled upon password_hash.

From what I understand (based on reading on this page), when you use password_hash, the salt is already generated on the line. is this real?

I have another question, is it wise to use two salts? One is stored directly in the file and the other is stored in the database? This way, if someone breaks the salt in the database, you still have a salt in the file. I've read here that it's never a wise idea to store salt, but it always baffles me when people say this.

Answer 1

Yes, you understand correctly, the function password_hash() will automatically generate a salt and include it in the generated hash value. It is perfectly correct to store the salt in the database, it will work even if it is known.

// 为在数据库中存储的新密码生成哈希值。
// 该函数会自动生成一个密码学安全的盐。
$hashToStoreInDb = password_hash($_POST['password'], PASSWORD_DEFAULT);

// 检查输入的登录密码的哈希值是否与存储的哈希值匹配。
// 盐和成本因素将从$existingHashFromDb中提取。
$isPasswordCorrect = password_verify($_POST['password'], $existingHashFromDb);

The second salt you mentioned (the salt stored in the file), is actually a pepper or server side key. If you add it before the hash (like salt), then you've added a chili pepper. But there is a better way, you can calculate the hash value first and then encrypt the hash value using the server side key (two-way encryption). This way you can change the key if necessary.

Unlike the salt, this key should be kept secret. People often get confused and try to hide the salt, but it's better to let the salt do its thing and use the key to add the secret.

Answer 2

Using password_hash is the recommended way to store passwords. Don't store them separately in database and files.

Suppose we have the following input:

$password = $_POST['password'];

First hash the password by:

$hashed_password = password_hash($password, PASSWORD_DEFAULT);

Then check the output:

var_dump($hashed_password);

As you can see, it has been hashed. (I assume you have completed these steps).

Now store this hashed password in your database, Make sure your password column is large enough to accommodate the hash value (at least 60 characters or longer) . When a user requests a login, you can check that the hash in the database matches the password input via:

// 查询数据库获取用户名和密码
// ...

if(password_verify($password, $hashed_password)) {
    // 如果密码输入与数据库中的哈希密码匹配
    // 做一些操作，你懂的... 登录他们。
} 

// 否则，将他们重定向回登录页面。

Official Reference Document