登录时检查哈希密码

Question

Next thing bothers me: hashing password makes them practically irreversible. So if I store password in database with any of hash alghorytms, on next login, how will I check is the password in database? Or simplier I wonder how to decrypt hashed password when logging?

Answer 1

You hash the password the user provides using the same algorithm and compare it against the stored one.

In PHP 5.5, there are new functions password_hash and password_verify built in for this that use the industy-standard bcrypt algorithm. In PHP 5.4 and PHP 5.3 (v 5.3.7+), the password_compat library provides the same functions.