Why should passwords always be hashed before storing them in a database, and how does PHP's password_hash function make this straightforward and secure?

Passwords must never be stored as plain text because if a database is ever breached, plain text passwords would immediately expose every user's actual password, whereas a properly hashed password uses a one way cryptographic function that cannot be reversed, so even if an attacker gains access to the hashed values, they cannot easily recover the original passwords, and PHP's password_hash function automatically handles generating a secure random salt and uses a strong, regularly updated hashing algorithm by default, removing the need to implement this security sensitive logic yourself.

$hashed = password_hash($plainPassword, PASSWORD_DEFAULT);

if (password_verify($inputPassword, $hashed)) {
    echo 'Login successful';
}