How can you use hashing to protect passwords in mySQLi?

2 How to hash passwords in PHP?

PHP provides several built-in functions that can help you hash and verify passwords securely. The most recommended one is password_hash(), which uses a strong algorithm called bcrypt and adds a random salt to the password before hashing it. A salt is a random string that makes the hash more unique and resistant to attacks. The password_hash() function returns a hash that includes the algorithm, the salt, and the actual hashed password, separated by $ signs. You can use password_verify() to check if a plain text password matches a hashed password, without knowing the salt or the algorithm. Here is an example of how to use these functions:

// Hash a password
$password = "secret123";
$hash = password_hash($password, PASSWORD_DEFAULT);
// Verify a password
if (password_verify($password, $hash)) {
    echo "Password is valid";
} else {
    echo "Password is invalid";
}        

3 How to store hashed passwords in mySQLi?

To store hashed passwords in mySQLi, you need to create a column in your users table that can hold the hash value. The hash value returned by password_hash() is usually 60 characters long, but it may vary depending on the algorithm and the salt. Therefore, it is recommended to use a VARCHAR column with a length of 255 characters, to ensure that the hash can fit in any case. You can use the mySQLi prepared statements to insert and update hashed passwords in your database, which will prevent SQL injection attacks. Here is an example of how to create a users table with a hashed password column and insert a user with a hashed password:

// Create a users table with a hashed password column
$sql = "CREATE TABLE users (
    id INT NOT NULL AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    password VARCHAR(255) NOT NULL
)";
// Connect to the database
$mysqli = new mysqli("localhost", "user", "pass", "database");
// Execute the query
$mysqli->query($sql);
// Hash a password
$password = "secret123";
$hash = password_hash($password, PASSWORD_DEFAULT);
// Insert a user with a hashed password
$sql = "INSERT INTO users (username, password) VALUES (?, ?)";
// Prepare the statement
$stmt = $mysqli->prepare($sql);
// Bind the parameters
$stmt->bind_param("ss", $username, $hash);
// Execute the statement
$stmt->execute();        

4 How to retrieve hashed passwords in mySQLi?

To retrieve hashed passwords in mySQLi, you need to select the password column from the users table and use the password_verify() function to compare it with the plain text password entered by the user. You can use the mySQLi prepared statements to select the password from the database, which will prevent SQL injection attacks. Here is an example of how to retrieve a hashed password and verify it:

// Get the plain text password from the user input
$password = $_POST['password'];
// Get the username from the user input
$username = $_POST['username'];
// Select the password from the users table
$sql = "SELECT password FROM users WHERE username = ?";
// Connect to the database
$mysqli = new mysqli("localhost", "user", "pass", "database");
// Prepare the statement
$stmt = $mysqli->prepare($sql);
// Bind the parameter
$stmt->bind_param("s", $username);
// Execute the statement
$stmt->execute();
// Fetch the result
$result = $stmt->get_result();
// Get the hashed password
$row = $result->fetch_assoc();
$hash = $row['password'];
// Verify the password
if (password_verify($password, $hash)) {
    echo "Password is valid";
} else {
    echo "Password is invalid";
}