PHP Password_hash () Use instance _php Tutorial

First, preface
PHP5.5 provides a number of new features and API functions, one of which is the password Hashing API (creating and validating hashed passwords).
It consists of 4 functions: Password_get_info (), Password_hash (), Password_needs_rehash (), Password_verify ().
Before PHP5.5, our password encryption may be more in the form of MD5 or SHA1 encryption (no one like the csdn to save the text. ), such as:
echo MD5 ("123456"); Output: e10adc3949ba59abbe56e057f20f883e
But simple MD5 encryption is easy to crack through the way of a dictionary, find a MD5 decrypted website can get the original password.
Second, Password Hashing API
The password Hashing API provided by php5.5 is a good solution to these problems.
Let's first look at the Password_hash () function:
Copy CodeThe code is as follows: String Password_hash (String $password, Integer $algo [, array $options])
It has three parameters: password, hash algorithm, options. The first two items are required.
Let's simply create a hash password using Password_hash ():
Copy CodeThe code is as follows: $pwd = "123456";
$hash = Password_hash ($pwd, Password_default);
Echo $hash;
The above example outputs similar: $2Y$10$4KAU4FNGUOLMRMSSHGKEME3DBG5PM3DIIKFKIAKNH.SF1TPBB4UO2
and refresh the page the hash value will also change continuously.
When the hash value is created, we can use Password_verify () to verify that the password matches the hash value:
Copy CodeThe code is as follows: Boolean password_verify (String $password, String $hash)

It receives 2 parameters: a password and a hash value, and returns a Boolean value. Check that the previously generated hash value matches the password:
Copy the code as follows: if (Password_verify ($pwd, ' $2y$10$4kau4fnguolmrmsshgkeme3dbg5pm3diikfkiaknh.sf1tpbb4uo2 ')) {

echo "Password is correct";
} else {
echo "Password Error";
}

Basically using these 2 functions will be able to safely create and verify the hash password, there are 2 additional API functions:
Copy the Code code as follows: Password_get_info ()//view information about the hash value
Password_needs_rehash ()//check if a hash value was created using a specific algorithm and options
Third, reviews
Although the hash password created by Password_hash () is more secure, it reduces interoperability.
If we use the MD5 method, in PHP with standard MD5 encryption, it is easy to verify in other languages, such as node. JS:
Copy the code as follows: var hash = crypto.createhash (' MD5 '). Update ("123456"). Digest (' Hex ');
if (hash = = "e10adc3949ba59abbe56e057f20f883e") console.log (' password correct ');
The hash value encrypted with Password_hash () can only be verified by PHP's password_verify.
Each of the 2 methods has pros and cons, is the use of MD5 (or SHA1, etc.) +salt (interfering with the string) or using Password_hash () people according to the specific circumstances of the choice.

http://www.bkjia.com/PHPjc/742453.html www.bkjia.com true http://www.bkjia.com/PHPjc/742453.html techarticle Preface PHP5.5 provides many new features and API functions, one of which is the password Hashing API (creating and verifying hashed passwords). It consists of 4 functions: Password_get_info (), Passwor ...

