Trying to understand password_verify PHP

前端 未结 1 1859
醉梦人生
醉梦人生 2021-01-27 11:14

I am trying to understand how password_verify work to use it for resetting the password. I would\'ve thought this would\'ve worked, but the hashed don\'t seem to match?

相关标签:
1条回答
  • 2021-01-27 11:30

    Every hash generated using password_hash() is salted with a different salt, so $sHash1, $sHash2 and $sHash3 will all be different

    password_verify() is used to compare a plaintext password against a hashed password, not two hashes with each other; use password_verify() to compare $sUniqueCode with any of the hashes that you have generated

    if (password_verify($sUniqueCode, $sHash1)) { ... }
    

    EDIT

    Rather than sending a password hash through email, which isn't useful in any way, send a nonce link for initial account access, or new password generation

    0 讨论(0)
提交回复
热议问题