Secure Password Storage
Hash passwords with password_hash and verify with password_verify.
Never Store Plaintext Passwords
Storing passwords in plaintext means a database breach exposes every user's password. Always store a cryptographic hash — ideally bcrypt, Argon2id, or scrypt.
password_hash()
PHP's built-in password_hash() creates a secure hash with a random salt included in the output.
<?php
$hash = password_hash("mysecretpassword", PASSWORD_BCRYPT);
// Output: $2y$10$... (includes algorithm, cost, salt, hash)All lessons in this course
- Cross-Site Scripting (XSS) Prevention
- SQL Injection and Parameterized Queries
- CSRF Protection
- Secure Password Storage