Who is already using this function, tell me how to properly organize the processing of passwords with its help so as not to spoil authorization with a password and protect the hash in the database?

approx.
which column to use in the MySQL database
how long should the column be
function handling example

    2 answers 2

    let's say during registration the server receives the password, then it processes it with the help of ala

    $finite_password password_hash($password, PASSWORD_DEFAULT);

    then you write $ finite_password into the database (you can make a field like varchar (255), as recommended on php).

    Edit (thanks @ fine). When logging in

     password_verify ($(пароль полученный от пользователя), $(хешированный пароль из базы))

    password_verify returns TRUE or FALSE, if the value is TRUE then you authorize, and if FALSE is an error, everything is ready. I hope I understand your question correctly.

    • one
      "doing the same process with the password you got" is not the same. Far from the same. password_hash always generates a new hash. To check whether the transferred password is suitable for the existing hash, the password_verify function is done - Minor
    • @ Small thanks for correcting me - Clara Oswald

    which column to use in the MySQL database

    any suitable. for example, text .

    how long should the column be

    for example, default.

    function handling example

    for example, from the documentation page :

     $ php -r 'echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT)."\n";' $2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1a
    • Yes, the manual is read first. Examples looked. How to deal with algorithms, what to choose? For example, PASSWORD_BCRYPT with which parameters it is better to use or still use PASSWORD_DEFAULT and not bother? - Plush
    • if you get the question “what is better?”, then the choice of the default option, I think, will satisfy you. but when (if) it ceases to be satisfied, then by that moment you will probably already know what exactly you need. - aleksandr barakin 7:09 pm
    • It is rather strange to choose "what's better" from one option =) At the moment DEFAULT points to BCRYPT - Shallow