When you hash a password with password_hash
, a random salt is being generated, used in the hashing process and prepended to the result. This is precisely for the purpose of avoiding the same passwords resulting in the same hash every single time; to avoid easy generation of rainbow tables. (All terms you should probably google. :))
To verify a hash generated with password_hash
you need to use password_verify
, which uses the salt embedded in the hash to reproduce and compare the hash from another plaintext password.