注册和登录时，PHP密码哈希不一样[关闭]

Question

When a user registers and logs in, I use the same password_hash function to hash the plain-text password.

password_hash($password, PASSWORD_DEFAULT)

However the password is not the same.

I can prove this another way by simply registering two users with the same password.

For example "admin" turns into "$2y$10$SyqILazLbo4jJVYvxYfwW.WgHUnSi.cRMETWoMjZXwMNa4H4tYELK"

on one user, and "$2y$10$gXfVz6oH4afxAL.7ytFJseZV3VERxbSYXqN7FYsRzH4IrjJw9uyO6" on another. This means the password_hash will never be the same, so user cann ever log in.

What am I doing wrong?

Answer 1

You need to use password_verify for verifying if password is correct or not. Something like this

<?php

$password = "rasmuslerdorf";

$hash =  password_hash($password, PASSWORD_DEFAULT);

if (password_verify($password, $hash)) {
  echo 'Password is valid!';
} else {
  echo 'Invalid password.';
}

?>

reference page