I am trying to understand how password_verify work to use it for resetting the password. I would\'ve thought this would\'ve worked, but the hashed don\'t seem to match?
Every hash generated using password_hash() is salted with a different salt, so $sHash1
, $sHash2
and $sHash3
will all be different
password_verify() is used to compare a plaintext password against a hashed password, not two hashes with each other; use password_verify() to compare $sUniqueCode
with any of the hashes that you have generated
if (password_verify($sUniqueCode, $sHash1)) { ... }
EDIT
Rather than sending a password hash through email, which isn't useful in any way, send a nonce link for initial account access, or new password generation