Sorry for this probably noobish question. So far, I've read password comparison/verification is implicitly understood to be made on the application layer and not in the database. For example in PHP, it would be done using the
password_verify() function and not via a query like
SELECT * WHERE username = foo AND password_hash = $2y$10$blahblah
What would be a solid case against this? Or is this a perfectly valid approach to password comparison/verification?