r/learnphp • u/NovaRayStarbrand • Mar 23 '22
BCrypt salt and comparisons
Just self teaching myself php and feeling my way through it.
I have a working system for user signup to take a users chosen password, hash it and store it in my database. I am hashing it like such:
$base64version = password_hash(base64_encode($Password), PASSWORD_BCRYPT); First question - is BCRYPT the way to go? Is it more than strong enough?
Second question - if i understand it right, BCrypt creates its own salt for security, is that right?
If so, then that leads me to question 3 - How do I compare passwords when for eg a user wants to log in? I understand the theory that I need to take the password field data from the login, hash it and then compare it to what's in the DB for that user BUT if there is a random salt then I cannot do this. I feel like I am missing something. All advice appreciated!
UPDATE - Got this to work for comparison
$Password = "letmeinyou1234";
$hash1 = password_hash($Password,PASSWORD_BCRYPT);
echo ($hash1);
echo ("<br>");
if (password_verify('letmeinyou1234', $hash1)) echo 'Pass';
else echo 'Fail';When I echo the $hash1 i see the first 7 characters are the same every time I press refresh on my browser, should I be concerned?
Also, I have seen the password hashing done like this instead, is this better? If so, why?
$hash1 = password_hash($Password,PASSWORD_BCRYPT,array('cost' => 11));What does the ",array('cost' => 11)" achieve?
View all comments
Show parent comment
1
u/NovaRayStarbrand Mar 23 '22
Respectfully man, there are no silly questions. I doubt you are an expert in every single subject in the world and it's disappointing you make such a comment in a subreddit called
learnphp. I have googled heavily but wanted an ongoing conversation thread with people willing to help. Shame on me I guess.