Password hashing
// Registration
$hash = password_hash($passwordInput, PASSWORD_BCRYPT, ["cost" => 12]);
// Login
if (password_verify($passwordInput, $userHash)) { /* ok */ }Sessions
After login, you store user_id in the server-side session. The client gets a cookie with the session id, not the data.
What NOT to do
- Store passwords in clear or with MD5/SHA1.
- Keep sessions alive forever.
- Show messages like "email not found" (they leak valid accounts).
What to do
- Bcrypt or Argon2id, cost ≥ 12.
- Cookies
httponly,secure,samesite=lax. - Rate limit login attempts.