Password hashing and matching
However, there is a lot of talk about what implementations are secure and not secure. How does my method measure up? Is it secure? Are there more secure methods in PHP for hashing tokens and matching with tokens later on?

Since you're specifically asking about security, I think reviewing your security instead of your code is a valid answer in this case.
The rule in Security-land is &quot;don't do it yourself if others have done it better&quot;. It's basically a re-wording of &quot;Use the right tool for the job&quot; and &quot;It isn't encryption until you've taken the time to fully understand the concepts behind the encryption code&quot;.
If you want to do hashing right, make sure you read this  answer on Security.SE.
Basically, if you want to do it secure, use bcrypt. Since PHP 5.5 can be called with password_hash.
PHP itself also recommends bcrypt. Their example usage states something like that in the comments:
&lt;?php
/**
* We just want to hash our password using the current DEFAULT algorithm.
* This is presently BCRYPT, and will produce a 60 character result.
 *
 * Beware that DEFAULT may change over time, so you would want to prepare
 * By allowing your storage to expand past 60 characters (255 would be good)
 */
echo password_hash(&quot;rasmuslerdorf&quot;, PASSWORD_DEFAULT).&quot;\n&quot;;
?&gt;

If you don't want to be surprised by a changed default value, change PASSWORD_DEFAULT to PASSWORD_BCRYPT.
Note they have more examples with varying complexity on that site, but this should convey the basics. It's perfectly possible to hand a whole sleeve of options to the function.
As a last note, you want to handle tokens. Do not store tokens in your database, only store hashed tokens. See also Part II of this answer.
Update:
In the above I assume you're using PHP 5.5 or higher. See this answer for implementations when using a lower version.