Authenticate by loading the stored hash and calling password_verify(); never compare plaintext or hashes manually: ~~~php if (!password_verify($password, $user->passwordHash)) { throw new AuthenticationException(); } if (password_needs_rehash($user->passwordHash, PASSWORD_ARGON2ID)) { $user->replacePasswordHash(password_hash($password, PASSWORD_ARGON2ID)); } ~~~ Add rate limiting, secure session handling, and MFA where appropriate, and avoid exposing whether a username or password was wrong.
Installs into .claude/skills of the current project.
Are you the author of Php Security?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-php-security-ad19ca50)
Authenticate by loading the stored hash and calling password_verify(); never compare plaintext or hashes manually:
~~~php
if (!password_verify($password, $user->passwordHash)) {
throw new AuthenticationException();
}
if (password_needs_rehash($user->passwordHash, PASSWORD_ARGON2ID)) {
$user->replacePasswordHash(password_hash($password, PASSWORD_ARGON2ID));
}
~~~
Add rate limiting, secure session handling, and MFA where appropriate, and avoid exposing whether a username or password was wrong.
