Re: crypt() should raise error without 2nd parameter
| From: | Kalle Sommer Nielsen | Date: | Wed, 07 Aug 2013 13:21:30 +0000 |
| Subject: | Re: crypt() should raise error without 2nd parameter | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-68399@lists.php.net to get a copy of this message | ||
Hi Yasuo
2013/8/7 Yasuo Ohgaki <yohgaki@ohgaki.net>:
> Hi all,
>
> A user requested that crypt() should raise error without 2nd(slat)
> parameter.
>
> https://bugs.php.net/bug.php?id=55036
>
> crypt() without salt generates extremely weak password hash. In addition to
> this,
> PHP 5.5 has password_hash()
>
> This change should be applied from 5.5, IMHO.
This is a BC break, as the second parameter as noted is optional,
while I believe we can do it in 5.5, I don't think it is worth the
effort, neither to put a notice or similar (E_STRICT even), if the
second parameter is left out, and it should go in master instead which
I'm in favor of.
--
regards,
Kalle Sommer Nielsen
kalle@php.net