password_verify
Checks whether a password matches a hash.
Syntax
password_verify(string $password, string $hash): boolParameters
| Parameter | Type | Description |
|---|---|---|
| $password | string | The password the user entered. |
| $hash | string | The hash from the database. |
Return value
bool`true` if the password is correct.
Examples
A correct and a wrong password:
<?php
$hash = password_hash('secret', PASSWORD_DEFAULT);
var_dump(password_verify('secret', $hash));
var_dump(password_verify('guess', $hash));Output:
bool(true)
bool(false)Notes
Hashes cannot be compared with each other: password_hash() gives a different result for the same password every time. Only this function does the checking.
See also
- password_hash — Creates a password hash for storing in a database.
Related recipes
In the tutorial
- Security — The basics of PHP site security — XSS and escaping, SQL injection, password hashing, CSRF tokens and validating input.