php 5.5中的password_hash函数

Question

i have the following function that hashes a password and stores it in a database. i am trying to use the password_hash function in php 5.5 but its giving me weird results.

function hashpass($password)
{
    include("includes/config.php");

    $password = password_hash($password, PASSWORD_DEFAULT);
    return $password;
}

I then output the result for the same static password which i am just testing as "testpassword" and it keeps giving me different hashes. Why is that? if it keeps doing that i will never be able to verify the password because it will never yield the same hash for the exact same string.

Is there something that i need to configure or set before hand for this to work correctly?

Answer 1

When you hash a password with password_hash, a random salt is being generated, used in the hashing process and prepended to the result. This is precisely for the purpose of avoiding the same passwords resulting in the same hash every single time; to avoid easy generation of rainbow tables. (All terms you should probably google. :))

To verify a hash generated with password_hash you need to use password_verify, which uses the salt embedded in the hash to reproduce and compare the hash from another plaintext password.