This is my first time using password_hash and password_verify in PHP. Would this be the correct usage of password_hash and password_verify to log the user into the site? Is there anything I could do to make this function more secure?

/**
* @param  mixed $data Post data * @return mixed Checks if the user wants to be remembered and runs the corresponding function ('loginRemember', 'loginNoRemember') */ public function initiateLogin ($data) {
//Database Connection
$db = Database::getInstance(); //Defining values for query$username = trim($data['login_username']); //Grab password from database based on username$query = $db->getConnection()->prepare("SELECT password FROM users WHERE username = :username");$query->execute(array(
':username' => $username )); //Query Results$queryResults = $query->fetch(PDO::FETCH_ASSOC); //Check if the password is correct if(password_verify($data['login_password'], $queryResults['password'])) { if (isset($data['login_remember_me'])) {
$this->loginRemember($data);
} else {
$this->loginNoRemember($data);
}
} else {
}
}


Would this be the correct usage of password_hash and password_verify to log the user into the site

• I do understand the desire to structure your code via these kinds of comments, but it would be better to either just remove them, or to introduce additional functions, and to slightly change your method signature. You could for example add a function such as getUserPassword($connection,$username) (possibly in a User class, or possibly just a method getByUsername($connection,$username) in a user class, which returns a User object, on which you could call getPassword). That way, you don't need the comment, as the code is even clearer about what it does.