After PHP 5.5, the Password hashing API was introduced to create and verify hashed passwords. It comes with the kernel and does not require any extension installation and configuration. It mainly provides four functions for use:
● password_hash(): Create a hash of the password;
● password_verify(): Verify whether the password matches the hash;
● password_needs_rehash(): Check whether the given hash matches the given option;
● password_get_info(): Return relevant information about the specified hash.
1, password_hash(string password, int algo [, array options])
Use a one-way hashing algorithm of sufficient strength to generate a hash of the password. This function is compatible with crypt(), that is, the hash value generated by crypt() can be verified using the related functions of the Password hashing API.
● password: user password.
● algo: cryptographic algorithm constant. Values ??include:
● PASSWORD_DEFAULT: Use bcrypt algorithm. The final generated result may exceed 60 characters;
● PASSWORD_BCRYPT: Use the CRYPT_BLOWFISH algorithm to create the hash. The final result is a 60-character string, or FALSE on failure.
● salt: Manually provide the salt value for the hashed password. When omitted, the function automatically generates a random salt value for each password hash. This item has been abandoned in PHP 7.0;
● cost: represents the cost used by the algorithm. The default value is 10, which can be increased according to actual conditions.
2, password_verify(string password, string hash)
● password: Password provided by the user.
● hash: Hash value created by password_hash(). Returns TRUE if there is a match, FALSE otherwise. Timing attacks do not work on this function.
3、password_needs_rehash(string hash, integer algo [, array opitons])
● hash: the hash generated by password_hash();
● algo: cryptographic algorithm constant;
● options: an associative array containing related options.
4, password_get_info(string hash) hash
: The hash generated by password_hash(). Returns an associative array containing three elements:
● algo: password algorithm constant;
● algoName: algorithm name;
● options: provided when calling password_hash() Options.
Example
$str = 'chicken,run!'; $pwd1 = password_hash($str, PASSWORD_BCRYPT); $pwd2 = crypt($str); var_dump(password_verify('chicken,run!', $pwd1)); // 輸出 true var_dump(password_verify('chicken,ran!', $pwd1)); // 輸出 false var_dump(password_verify($str, $pwd2)); // 輸出 true var_dump(password_needs_rehash($pwd1, PASSWORD_BCRYPT, ['cost'=>10])); // 輸出 false,因?yàn)?password_hash() 在加密時(shí),出來(lái)默認(rèn) cost 為 10 外,還會(huì)指定隨機(jī)的鹽值
For more programming related content, please pay attention to the Programming Introduction column on the php Chinese website!
The above is the detailed content of PHP Encryption: Password Hashing API. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

The method to get the current session ID in PHP is to use the session_id() function, but you must call session_start() to successfully obtain it. 1. Call session_start() to start the session; 2. Use session_id() to read the session ID and output a string similar to abc123def456ghi789; 3. If the return is empty, check whether session_start() is missing, whether the user accesses for the first time, or whether the session is destroyed; 4. The session ID can be used for logging, security verification and cross-request communication, but security needs to be paid attention to. Make sure that the session is correctly enabled and the ID can be obtained successfully.

To extract substrings from PHP strings, you can use the substr() function, which is syntax substr(string$string,int$start,?int$length=null), and if the length is not specified, it will be intercepted to the end; when processing multi-byte characters such as Chinese, you should use the mb_substr() function to avoid garbled code; if you need to intercept the string according to a specific separator, you can use exploit() or combine strpos() and substr() to implement it, such as extracting file name extensions or domain names.

UnittestinginPHPinvolvesverifyingindividualcodeunitslikefunctionsormethodstocatchbugsearlyandensurereliablerefactoring.1)SetupPHPUnitviaComposer,createatestdirectory,andconfigureautoloadandphpunit.xml.2)Writetestcasesfollowingthearrange-act-assertpat

In PHP, the most common method is to split the string into an array using the exploit() function. This function divides the string into multiple parts through the specified delimiter and returns an array. The syntax is exploit(separator, string, limit), where separator is the separator, string is the original string, and limit is an optional parameter to control the maximum number of segments. For example $str="apple,banana,orange";$arr=explode(",",$str); The result is ["apple","bana

JavaScript data types are divided into primitive types and reference types. Primitive types include string, number, boolean, null, undefined, and symbol. The values are immutable and copies are copied when assigning values, so they do not affect each other; reference types such as objects, arrays and functions store memory addresses, and variables pointing to the same object will affect each other. Typeof and instanceof can be used to determine types, but pay attention to the historical issues of typeofnull. Understanding these two types of differences can help write more stable and reliable code.

std::chrono is used in C to process time, including obtaining the current time, measuring execution time, operation time point and duration, and formatting analysis time. 1. Use std::chrono::system_clock::now() to obtain the current time, which can be converted into a readable string, but the system clock may not be monotonous; 2. Use std::chrono::steady_clock to measure the execution time to ensure monotony, and convert it into milliseconds, seconds and other units through duration_cast; 3. Time point (time_point) and duration (duration) can be interoperable, but attention should be paid to unit compatibility and clock epoch (epoch)

ToaccessenvironmentvariablesinPHP,usegetenv()orthe$_ENVsuperglobal.1.getenv('VAR_NAME')retrievesaspecificvariable.2.$_ENV['VAR_NAME']accessesvariablesifvariables_orderinphp.iniincludes"E".SetvariablesviaCLIwithVAR=valuephpscript.php,inApach

LateStaticBindinginPHPallowsstatic::torefertotheclassinitiallycalledatruntimeininheritancescenarios.BeforePHP5.3,self::alwaysreferencedtheclasswherethemethodwasdefined,causingChildClass::sayHello()tooutput"ParentClass".Withlatestaticbinding
