You store a hash, not a password

A hash is one-way. You cannot turn it back into the password. You can only hash an attempt and compare.

$hash = password_hash($password, PASSWORD_DEFAULT);

PHP salts it for you, and PASSWORD_DEFAULT follows the current recommendation as PHP versions move on. You do not choose the algorithm; that is the point.

Verify, never re-hash and compare

if (password_verify($input, $row['password_hash'])) { ... }

Hashing the input and comparing strings yourself FAILS, because a fresh salt is generated every time, the same password hashes differently on every call. password_verify reads the salt out of the stored hash.

Not MD5, not SHA1

Both are fast, which is exactly what you do not want. Fast means billions of guesses per second on cheap hardware.

Write the PHP in the JS panel as a template string, the checker reads your code.