如何使用BCRYPT使用PHP / MySQL验证密码

Question

I don't understand how this works

$hash = $bcrypt->hash($_POST['password']); //this string is stored in mysql

Then when a user logs in,

//get hash string from above from mysql, then

if ($bcrypt->verify($_POST['password'], $row['password'])) {
   echo "Logged in.";
}

A.) Am I doing this correctly?

B.) If so, how does bcrypt remember the salt if it's not stored in the database?

Answer 1

The salt is prepended to the hash, and so the the function pulls the salt out of the hash from the database. This is why you have to pass the hash from the database to the verification function, instead of just rehashing the password and comparing them.

And yeah, it does look like you are doing it correctly.