code: public function validatePassword($password, $hash)
      {
          if (!is_string($password) || $password === '') {
              throw new InvalidArgumentException('Password must be a string and cannot be empty.');
          }
  
          if (!preg_match('/^\$2[axy]\$(\d\d)\$[\.\/0-9A-Za-z]{22}/', $hash, $matches)
              || $matches[1] < 4
              || $matches[1] > 30
          ) {
              throw new InvalidArgumentException('Hash is invalid.');
          }
  
          if (function_exists('password_verify')) {
              return password_verify($password, $hash);
          }
  
          $test = crypt($password, $hash);
          $n = strlen($test);
          if ($n !== 60) {
              return false;
          }
  
          return $this->compareString($test, $hash);
      }
docs: Verifies a password against a hash.
  @param string $password The password to verify.
  @param string $hash The hash to verify the password against.
  @return bool whether the password is correct.
  @throws InvalidArgumentException on bad password/hash parameters or if crypt() with Blowfish hash is not available.
  @see generatePasswordHash()