Making my site more secure, Am I using password_hash correct? [duplicate]

Question

I have a VERY small site and recently I've been trying to make it more secure, I used to store my passwords in plain text.

I think Im doing it right, but as a "hobby" programmer I wanna make sure so I ask you, the professionals

When a user register I do: password_hash($their_password, PASSWORD_DEFAULT) and store that in the 'password' column in the users table. I use PASSWORD_DEFAULT as that seems the best according to php.net.

Note that this constant is designed to change over time as new and stronger algorithms are added to PHP."

Sounds good!

And the Login part (very simple):

if (count($_POST) > 0) {

$username = trim($_POST['username']);
$password = trim($_POST['password']);

$query = $db->prepare("SELECT password FROM users WHERE username = ?");
$query->execute(array($username));
$row = $query->fetch();

if (password_verify($password, $row['password'])) {
    echo "Correct password";
    // create session...
} else {
    // wrong password
}

Maybe I should check if the username exists first but other than that what do you think?

Answer 1

You appear to have perfectly understood the documentation and how to construct the code you need. Shame on you for using plaintext password even temporarily, but your decision to fix with the correct method (ie. not md5 like _^me a silly person _{^{(I really need to update my password saving systems...)}}) is awesome.

The only issue I can see is that some people might have their passwords start or end with a space. Such passwords would lose their leading/trailing spaces and indeed the user may be alarmed that they can log in with two spaces, or none! So probably best to remove those trim calls ;)