Password Hashing in PHP (Do It the Right Way)

Never store plain passwords. Use password_hash and password_verify with step-by-step examples.

Passwords should never be stored as plain text, and never with weak hashing like md5.

PHP has built-in secure functions: - `password_hash` - `password_verify`

Signup: hash password

```php $password = $_POST['password']; $hash = password_hash($password, PASSWORD_DEFAULT);

$stmt = $pdo->prepare("INSERT INTO users (email, password_hash) VALUES (:email, :hash)"); $stmt->execute(["email" => $email, "hash" => $hash]); ```

```php $stmt = $pdo->prepare("SELECT * FROM users WHERE email=:email"); $stmt->execute(["email" => $email]); $user = $stmt->fetch();

if ($user && password_verify($password, $user['password_hash'])) { echo "Login success"; } else { echo "Invalid credentials"; } ```

It automatically chooses a strong algorithm and can improve over time with PHP updates.

> Next: Build a basic authentication system using sessions.