如何在 PHP 中使用带有 password_hash() 的 BCRYPT

Question

Now with password_hash() in PHP >=5.6, do we need to also use BCRYPT to make the object/password more secured?

If yes, then could any one please describe how to store a password in registration page using password_hash() AND BCRYPT, and then how to retrieve information to login user on login page?

Sorry if anyone is offended by a beginner's limited knowledge. I am confused and didn't quite get the answer.

UPDATE:

I got the idea now, there is no need to user BCRYPT/salt/pepper with password_hash() now as PHP creates its own random salt during runtime. The easiest step is to simply hash password using password_hash($passwordVariable) and for verification simply use password_verify($passwordEntered, $hashedPassword_fromDB). Thanks everyone.

Answer 1

There is no need to user BCRYPT/salt/pepper with password_hash() now as PHP creates its own random salt during runtime.

The easiest step is to simply hash password using password_hash($passwordVariable) and for verification simply use password_verify($passwordEntered, $hashedPassword_fromDB)

Answer 2

The whole idea behind password_hash() is to always use an up-to-date hashing algorithm. Currently, the default algo. used is exactly BCRYPT. It even allows you to pass more options in order to make your password even more secure(for example your own salt or work factor). And what's even better, is that php also offers the password_needs_rehash() function that allows you to check later if a given hash was created using the current algo,and if not, you can just rehash the password. Check out the official php documentation page for pasword_hash(): http://php.net/manual/en/function.password-hash.php