PHP Password_hash () Use instance _php instance

First, the preface
PHP5.5 provides a number of new features and API functions, one of which is the password hashing API (creating and verifying hash passwords).
It contains 4 functions: Password_get_info (), Password_hash (), Password_needs_rehash (), Password_verify ().
Before the PHP5.5, our encryption of the password may be more to use the MD5 or SHA1 encryption methods (no one like the csdn to save the text of it. ), such as:
echo MD5 ("123456"); Output: e10adc3949ba59abbe56e057f20f883e
But simple MD5 encryption is easy to use dictionary way to crack, find a MD5 decrypt the site can get the original password.
Second, Password hashing API
The password hashing API provided by php5.5 can be a good solution to these problems.
Let's look at the Password_hash () function:

Copy Code code as follows:

String Password_hash (String $password, Integer $algo [, array $options])

It has three parameters: password, hash algorithm, option. The first two items are required.
Let's use Password_hash () to simply create a hash password:

Copy Code code as follows:

$pwd = "123456";
$hash = Password_hash ($pwd, Password_default);
Echo $hash;

The previous example output is similar to the result: $2y$10$4kau4fnguolmrmsshgkeme3dbg5pm3diikfkiaknh.sf1tpbb4uo2
and refresh the page the hash value will change constantly.
After the hash value is created, we can use Password_verify () to verify that the password matches the hash value:

Copy Code code as follows:

Boolean password_verify (String $password, String $hash)

It receives 2 parameters: Password and hash value, and returns a Boolean value. Check that the previously generated hash value matches the password:

Copy Code code as follows:

if (Password_verify ($pwd, ' $2y$10$4kau4fnguolmrmsshgkeme3dbg5pm3diikfkiaknh.sf1tpbb4uo2 ')) {

echo "Correct password";
} else {
echo "Password Error";
}

Basically using these 2 functions to create and verify the hash password securely, there are 2 other API functions:

Copy Code code as follows:

Password_get_info ()//view hash value related information
Password_needs_rehash () Check whether a hash value is created using a specific algorithm and option

Third, reviews
Although the hash password created by Password_hash () is more secure, it reduces interoperability.
If we use the MD5 approach, the standard MD5 encryption in PHP is easy to verify in other languages, such as Node.js:

Copy Code code as follows:

var hash = Crypto.createhash (' MD5 '). Update ("123456"). Digest (' Hex ');
if (hash = = "e10adc3949ba59abbe56e057f20f883e") console.log (' password correct ');

Hash values that are encrypted using Password_hash () are basically validated by PHP's password_verify.
These 2 methods have pros and cons, is the use of MD5 (or SHA1, etc.) +salt (interference string) or the use of Password_hash () the specific circumstances of the choice.