How do I use password hashing with PDO to make my code more secure? [closed]

by

Just use a library. Seriously. They exist for a reason.

Don’t do it yourself. If you’re creating your own salt, YOU’RE DOING IT WRONG. You should be using a library that handles that for you.

$dbh = new PDO(...);

$username = $_POST["username"];
$email = $_POST["email"];
$password = $_POST["password"];
$hash = password_hash($password, PASSWORD_DEFAULT);

$stmt = $dbh->prepare("insert into users set username=?, email=?, password=?");
$stmt->execute([$username, $email, $hash]);

And on login:

$sql = "SELECT * FROM users WHERE username = ?";
$stmt = $dbh->prepare($sql);
$result = $stmt->execute([$_POST['username']]);
$users = $result->fetchAll();
if (isset($users[0]) {
    if (password_verify($_POST['password'], $users[0]->password) {
        // valid login
    } else {
        // invalid password
    }
} else {
    // invalid username
}

More Related Contents:

  1. how safe are PDO prepared statements
  2. PHP PDO and Mysql [closed]
  3. PHP – Using PDO with IN clause array
  4. How to properly set up a PDO connection
  5. How can I store my users’ passwords safely?
  6. How to create a secure mysql prepared statement in php?
  7. PHP PDO prepared statements
  8. PDO MySQL: Use PDO::ATTR_EMULATE_PREPARES or not?
  9. Having issue with matching rows in the database using PDO
  10. PDO binding values for MySQL IN statement [duplicate]
  11. PDO mysql: How to know if insert was successful
  12. SQL injections in ADOdb and general website security
  13. How can I properly use a PDO object for a parameterized SELECT query
  14. How do I return integer and numeric columns from MySQL as integers and numerics in PHP?
  15. implement LIKE query in PDO
  16. PHP PDO prepared statement — MySQL LIKE query
  17. Fetching single row, single column with PDO
  18. How do I loop through a MySQL query via PDO in PHP?
  19. PDO error: SQLSTATE[HY000]: General error: 2031
  20. Laravel 5.4 on PHP 7.0: PDO Exception – Could not find driver (MySQL)
  21. Using LIKE in bindParam for a MySQL PDO Query [duplicate]
  22. How to handle PDO exceptions [duplicate]
  23. php artisan migrate throwing [PDO Exception] Could not find driver – Using Laravel
  24. PDO and MySQL Fulltext searches
  25. How to escape single-quote (apostrophe) in string using php
  26. PHP Laravel: No connection could be made because the target machine actively refused it
  27. Best way to connect to MySQL with PHP securely [duplicate]
  28. PDO bindParam into one statement?
  29. What is the PDO equivalent of function mysql_real_escape_string?
  30. Installing PDO driver on MySQL Linux server

Leave a Comment