Authentication Deep Dive 🔐

<?php
// NEVER store a password as plain text. Hash it one way instead.
// password_hash() turns a password into a long, salted hash you can store.

$plain = "correct horse battery staple";

// PASSWORD_DEFAULT uses bcrypt today (and upgrades automatically in future PHP).
$hash = password_hash($plain, PASSWORD_DEFAULT);

echo "Stored hash:\n$hash\n\n";

// The same password hashed TWICE gives two DIFFERENT hashes — each has a random salt.
$again = password_hash($plain, PASSWORD_DEFAULT);
echo "Hashed again (different salt):\n$again\n\n";

// To check a login you don't decrypt — you VERIFY with password_verify().
echo "Right password? " . (password_verify($plain, $hash) ? "yes" : "no") . "\n";
echo "Wrong password? " . (password_verify("guessing", $hash) ? "yes" : "no") . "\n";
?>

Stored hash:
$2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

Hashed again (different salt):
$2y$10$IjZAgcfl7p92ldGxad68LeoN9qo8uLOickgx2ZMRZoMyeMkR3pFq.

Right password? yes
Wrong password? no

<?php
// You can pick the algorithm and tune how slow (= how strong) it is.

$plain = "hunter2";

// bcrypt with a higher "cost" — each step doubles the work an attacker needs.
$bcrypt = password_hash($plain, PASSWORD_BCRYPT, ["cost" => 12]);
echo "bcrypt (cost 12): " . substr($bcrypt, 0, 7) . "...\n";

// Argon2id is the modern memory-hard choice (PHP 7.3+ built with Argon2).
if (defined("PASSWORD_ARGON2ID")) {
    $argon = password_hash($plain, PASSWORD_ARGON2ID);
    echo "argon2id:          " . substr($argon, 0, 9) . "...\n";
}

// password_get_info() tells you which algorithm a stored hash used.
$info = password_get_info($bcrypt);
echo "Algorithm name:   " . $info["algoName"] . "\n";
?>

bcrypt (cost 12): $2y$12$...
argon2id:          $argon2id...
Algorithm name:   bcrypt

<?php
// REGISTRATION: store the HASH (never the password) using a prepared statement.

$pdo = new PDO("sqlite::memory:");           // demo DB; swap for your real DSN
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$pdo->exec("CREATE TABLE users (
    id INTEGER PRIMARY KEY,
    email TEXT UNIQUE NOT NULL,
    password_hash TEXT NOT NULL
)");

function registerUser(PDO $pdo, string $email, string $password): string {
    // 1) Hash the plain password — this is the ONLY form we ever store.
    $hash = password_hash($password, PASSWORD_DEFAULT);

    // 2) Prepared statement: ? placeholders keep user input OUT of the SQL.
    $stmt = $pdo->prepare(
        "INSERT INTO users (email, password_hash) VALUES (?, ?)"
    );
    $stmt->execute([$email, $hash]);          // values bound safely, no injection
    return "Registered $email (id " . $pdo->lastInsertId() . ")";
}

echo registerUser($pdo, "ada@example.com", "s3cret-pw") . "\n";

// The row holds a hash, not the password:
$row = $pdo->query("SELECT email, password_hash FROM users")->fetch(PDO::FETCH_ASSOC);
echo "Saved email: {$row['email']}\n";
echo "Saved value is a hash, not the password: "
   . (str_starts_with($row['password_hash'], '$2y$') ? "true" : "false") . "\n";
?>

Registered ada@example.com (id 1)
Saved email: ada@example.com
Saved value is a hash, not the password: true

<?php
// LOGIN: fetch the user by email, verify the password, then start a session.
session_start();                              // must come before any output

function login(PDO $pdo, string $email, string $password): bool {
    // Fetch the stored hash for this email (prepared statement again).
    $stmt = $pdo->prepare("SELECT id, password_hash FROM users WHERE email = ?");
    $stmt->execute([$email]);
    $user = $stmt->fetch(PDO::FETCH_ASSOC);

    // No such user OR wrong password -> same generic failure (don't leak which).
    if (!$user || !password_verify($password, $user['password_hash'])) {
        return false;
    }

    // Success: prevent session fixation, then remember who is logged in.
    session_regenerate_id(true);              // new session id on privilege change
    $_SESSION['user_id'] = $user['id'];
    return true;
}

// (Assume $pdo already has ada@example.com / "s3cret-pw" from registration.)
echo login($pdo, "ada@example.com", "wrong-pw") ? "logged in\n" : "login failed\n";
echo login($pdo, "ada@example.com", "s3cret-pw") ? "logged in\n" : "login failed\n";
echo "Session user_id: " . ($_SESSION['user_id'] ?? "none") . "\n";
?>

login failed
logged in
Session user_id: 1

<?php
// PROTECT A PAGE: anything below this guard only runs for logged-in users.
session_start();

function requireLogin(): int {
    if (!isset($_SESSION['user_id'])) {
        header("Location: /login.php");       // send guests to the login page
        exit;                                 // STOP — never let protected code run
    }
    return $_SESSION['user_id'];
}

$userId = requireLogin();
echo "Welcome back, user #$userId — this is your private dashboard.\n";

// LOGOUT: clear the data, destroy the session, drop the cookie.
function logout(): void {
    $_SESSION = [];                           // empty the session array
    if (ini_get("session.use_cookies")) {
        setcookie(session_name(), "", time() - 3600, "/");  // expire the cookie
    }
    session_destroy();                        // wipe the server-side session
}
?>

Welcome back, user #1 — this is your private dashboard.

<?php
// 🎯 YOUR TURN — register, then log in. Fill each blank marked ___ , then run it.

$password = "open-sesame";

// 1) Turn the plain password into a storable hash.
$hash = ___($password, PASSWORD_DEFAULT);   // 👉 the function that HASHES a password

echo "Stored: " . substr($hash, 0, 7) . "...\n";

// 2) A correct login must VERIFY the typed password against the stored hash.
$typed = "open-sesame";
$ok = ___($typed, $hash);                   // 👉 the function that CHECKS a password

echo "Login correct? " . ($ok ? "yes" : "no") . "\n";

// 3) A wrong password must fail.
echo "Wrong pw? " . (password_verify("nope", $hash) ? "yes" : "no") . "\n";

// ✅ Expected output:
//    Stored: $2y$10$...
//    Login correct? yes
//    Wrong pw? no
?>

Stored: $2y$10$...
Login correct? yes
Wrong pw? no

<?php
// 🎯 YOUR TURN — finish the prepared statement so the email can't break the SQL.

$pdo = new PDO("sqlite::memory:");
$pdo->exec("CREATE TABLE users (id INTEGER PRIMARY KEY, email TEXT, password_hash TEXT)");

$email = "grace@example.com";
$hash  = password_hash("battery-staple", PASSWORD_DEFAULT);

// 1) Use a ? placeholder for EACH value instead of putting them in the SQL.
$stmt = $pdo->prepare(
    "INSERT INTO users (email, password_hash) VALUES (___, ___)"   // 👉 two placeholders
);

// 2) Pass the real values as an array, in the same order.
$stmt->execute([___, ___]);                 // 👉 the email, then the hash

$saved = $pdo->query("SELECT email FROM users")->fetchColumn();
echo "Saved: $saved\n";

// ✅ Expected output:
//    Saved: grace@example.com
?>

Saved: grace@example.com

<?php
// "REMEMBER ME": store a random token (hashed in the DB) in a long-lived cookie.

// On login, IF the user ticked "remember me":
$selector = bin2hex(random_bytes(6));         // public lookup id
$validator = bin2hex(random_bytes(32));       // secret, sent to the browser only
$storeHash = hash('sha256', $validator);      // hash before saving — like a password

// Save [selector, storeHash, user_id, expiry] in a remember_tokens table, then:
setcookie("remember", "$selector:$validator", [
    "expires"  => time() + 60 * 60 * 24 * 30, // 30 days
    "path"     => "/",
    "httponly" => true,                       // JavaScript can't read it (anti-XSS)
    "secure"   => true,                       // HTTPS only
    "samesite" => "Lax",                      // limits cross-site sending (anti-CSRF)
]);

// REHASH ON LOGIN: if your cost/algorithm has been upgraded, refresh the stored hash.
$storedHash = '$2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy';
$plain = "s3cret-pw";
if (password_verify($plain, $storedHash)
    && password_needs_rehash($storedHash, PASSWORD_DEFAULT, ["cost" => 12])) {
    $newHash = password_hash($plain, PASSWORD_DEFAULT, ["cost" => 12]);
    echo "Hash upgraded to cost 12 — save \$newHash back to the users row.\n";
} else {
    echo "Hash is current — nothing to do.\n";
}
?>

Hash upgraded to cost 12 — save $newHash back to the users row.