PHP authentication

Login

• Store hash of password in database
• Check password by fetching row based on username, then use password_verify (which is safe against timing attacks)
• After a successful verification, call password_needs_rehash to see if the hash needs to be updated