title: Are PHP's password_hash and password_verify functions enough?
body: <p>I'm building a site that <strong>has users on them,</strong> and as with most sites housing some user-type system, they sign in with <strong>their e-mails and passwords</strong>. I'm <strong>using PHP</strong> for the back-end portion of my site.</p>
  
  <p>After reading up some articles and posts on the Internet, I learned of the PHP functions <strong>password_hash()</strong> and <strong>password_verify()</strong> and wanted to know if an example procedure such as this one was <strong>secure enough?</strong></p>
  
  <ol>
  <li>Register the user, <strong>password_hash()</strong> their password and <strong>store the hash in the database</strong>.</li>
  <li>When logging in, use <strong>password_verify()</strong> to verify the password and <strong>log them in</strong>.</li>
  <li>If they want to change their password, get their input and <strong>password_hash() the input again.</strong></li>
  </ol>
  
  <p>So the questions I have with this are <strong>as follows:</strong></p>
  
  <ol>
  <li>Are password_hash() and password_verify() the <strong>only functions</strong> I need?</li>
  <li>Can I take <strong>raw user input</strong> and <strong>safely</strong> hash a password using <strong>password_hash()</strong> for storage in a <strong>database</strong>?</li>
  </ol>
  
  <p>Any answers would be greatly be appreciated. Thank you.</p>