address. All right, that's easy enough. Scroll down to the home view, and excuse me, I will have it say hello, and then let's look in the session for our user, and then grab their email address. Otherwise, if we don't have a signed in user, we can default to guest. Okay, and I think that should do the trick. Now we see hello, Joe at Joe.com. Okay, great. So yeah, now if I switch back to TablePlus once again, all right, and yeah, here we can see that we're storing Joe's password in clear text.

some kind of database breach? Right? Well, when that happens, the attackers gain access to a users table. That includes your email address and your actual password that they can then use for, I don't know, financial institutions to sign into your Facebook account, whatever they want to do there. It is a horrible practice. So we need to fix this right now. I'm going to delete that account entirely, and I'll switch back to phpStorm. And let's do this.

I'm going to delete that account entirely, and I'll switch back to phpStorm. And let's do this. Let's go into our RegistrationController, store. So this is where we submit the form. And yeah, if we scroll down, we validate. It's still a little messy here. We need to clean it up a little later. But yeah, right down here, I even added a little note in the source code, never store. So I'm going to say it 11 times, it seems. All right.

So I'm going to say it 11 times, it seems. All right. So it sounds like when I insert the user's password into the database, I need to hash it. And luckily, php makes this pretty darn easy. I can wrap this in a call to password_hash. And if I click through here to the signature, yeah, so we're going to provide it as the first argument, the user's password. And then as the second argument, which algorithm, which password hashing algorithm we want to use at the time of this recording, you don't even need to know what it is.

And then as the second argument, which algorithm, which password hashing algorithm we want to use at the time of this recording, you don't even need to know what it is. But it's called bcrypt, and it's incredibly secure. So it also happens to be the default. So as the second argument, we can reference a constant of PASSWORD_BCRYPT. Or again, if we did PASSWORD_DEFAULT at the time of this recording, that default is bcrypt. So just keep in mind, if you choose this option, maybe in five years, it will change. So if you want to force bcrypt, you can use it like this. Otherwise, you can stick with the default. All right.