PHP password_hash function value isn't same for each string

Question

I'm try to hash user password with using password_hash() PHP function.But,it function is work hashing,not constant.

<?php 
    echo password_hash('a',PASSWORD_BCRYPT,array(
            'cost' => 12
         ));
?>

Result for 4th testing time

1. $2y$12$SRmipqM7AsYkx3Xc8QGHNex69rGXeVyWGTYrh9T8sh1cP3UrdjfQi
2. $2y$12$zx.GUgtcake3wMfl3/YXXeG1.8mmHKyRruL3nWj8OmA.RbEYqeW6u
3. $2y$12$XQtmFplcehkgWLbGrOUsNOlXDU/NGrwZlt3HM88hLbUHXhjXNF4km
4. $2y$12$q9/OSZdDJw7af4Hw4MGlHeY7UMtWr9/Cj0nj/N6PaoilNoUBePt7O

Answer 1

As some suggested to use MD5, Do not use it for password hashing.

Well now to answer your question how to check a password matches

Password_Hash() is to generate a password hash, which will create a random salt with it, this hash will be used upon hashing. your end result would be: salt+hash, however you can give it a salt with this method in it's options but let's keep it that it does it by itselves.

Password_Verify() uses a parameter for the password and one for the hashed password. as I said earlier the hashed password is salt+hash which makes sense that Password_Verify() only need these and not an additional called salt

So what happens with Password_Verify() is that it takes out the salt and use Password_Hash() with that salt. then check if the received hash equals the given hash. if it matched then it's true, else it's false.

Password_Hash() Doc

Password_Verify() Doc

---

Update 18-04-2018 (d-m-Y)

WARNING

The salt option has been deprecated as of PHP 7.0.0.

It is now preferred to simply use the salt that is generated by default.

More information about Salting - SO Answer below by Veve

Why not to use MD5 for Password Hashing - PHP FaQ Answer

Why not to use MD5 for Password Hashing - SO Answer by: Silverlightfox