Challenge 2 — Solution

Task: Using password_hash() and password_verify(), write a script that
hashes the password "MySecret123", then checks two test inputs — one
matching, one not — against the hash, echoing whether each one would be
allowed to log in.

<?php
    $storedHash = password_hash("MySecret123", PASSWORD_DEFAULT);

    $attempt1 = "MySecret123";
    $attempt2 = "wrongpassword";

    if (password_verify($attempt1, $storedHash)) {
        echo "Attempt 1 ('$attempt1'): Login allowed.<br>";
    } else {
        echo "Attempt 1 ('$attempt1'): Login denied.<br>";
    }

    if (password_verify($attempt2, $storedHash)) {
        echo "Attempt 2 ('$attempt2'): Login allowed.<br>";
    } else {
        echo "Attempt 2 ('$attempt2'): Login denied.<br>";
    }
?>


Output:
Attempt 1 ('MySecret123'): Login allowed.
Attempt 2 ('wrongpassword'): Login denied.

Notes:
- $storedHash never contains the plain-text password "MySecret123" -
  password_hash() produces a scrambled, one-way string; printing
  $storedHash directly would show something unrecognisable, not the
  original password.
- password_verify() checks a plain-text attempt against the hash by
  re-running the same hashing process on the attempt and comparing the
  results internally - it never "decrypts" the stored hash back into
  readable text, because that genuinely isn't possible with this
  algorithm.
- Attempt 1 matches exactly, so password_verify() returns true;
  Attempt 2 is a completely different string, so it returns false -
  demonstrating the correct, safe way to check a login attempt without
  ever storing or comparing raw passwords directly.