Comparing passwords to stored hash [duplicate]

Answer 1

the hash is generated randomly each time

No, the hash is always the same for a given input, salt value and iterations through which the hash algorithm is run (which is controlled by the cost parameter).

The concept I am having trouble understanding is how one would check the password input against the hashed value if it is stored in a database rather than the being known by the page at that point in time?

You would check the password input at login time, using the password provided by the user, and the salt and potentially number of times to apply the hash algorithm associated with that user. Once the password check is successful, use a session or other mechanism to keep the user logged in.

Answer 2

Look at the examples for password_hash() and password_verify() together.

The hash-string that's produced by password_hash is self-describing: it incorporates an indication of both the algorithm and the random-salt that was used. password_verify knows about all this. It knows how to "do the right thing" for passwords both recent and vintage.

Therefore, simply query the database to get the (hashed ...) password for this user. Then, use password_verify() to see if this hash-value matches this password-value.

You can't query for the user-name AND password at the same time. Query only for the user-name, get the hashed value, and use password_verify() to check it.