password_verify question

I'm rewriting all of our scripts to use the PHP5.5 password_hash.
My question is authenticating a user, I have to pull out the users hashed password before I can authenticate them. I've always been under the impression that it's bad practice to ever pull a password out regardless of if it's hashed.
Am I missing something here?

See original post by scottlpool2003

Leave a Reply