PHPAML

Documentation · Chapter 14

Build a complete password utility.

This workshop asks for a password without displaying it when possible, hashes it securely, verifies it, and tests the responsible class.

Every lesson starts from the problem, explains the mechanism, then gives a concrete verification.

LESSON OBJECTIVE

What you will be able to do

Combine prompting, validation, hashing, verification, objects, and tests into one small maintainable tool.

Separate interaction from hashing

PasswordHasher owns hash and verify. Program owns prompts and messages. Neither class needs to know the terminal implementation of the other.

phpaml — zsh
$hash = password_hash($password, PASSWORD_DEFAULT);
if (!password_verify($confirmation, $hash)) {
    throw new RuntimeException('Passwords do not match.');
}

Verify instead of decrypting

password_verify compares an entered value with the stored hash. There is intentionally no operation to reveal the original password.

Exercise success and failure

Test an accepted password, a rejected password, empty input, and an unreadable stream. Then run the real program.

CHECKPOINT

Before you continue

Can the program prove a password matches without ever recovering or printing the original value?

SUMMARY

What to remember

  • Console projects execute ordinary PHP.
  • Input, validation, output, and exit status form the basic cycle.
  • Classes and tests scale the same way as in Web projects.
  • Passwords are hashed and verified, never decrypted.