Re: crypt() should raise error without 2nd parameter
| From: | Hannes Magnusson | Date: | Thu, 08 Aug 2013 04:22:36 +0000 |
| Subject: | Re: crypt() should raise error without 2nd parameter | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-68423@lists.php.net to get a copy of this message | ||
On Wed, Aug 7, 2013 at 6:20 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi all,
>
> It seems there are 2 options for master branch when crypt()'s 2nd parameter
> is omitted.
>
> - raise E_DEPRECIATED that advice use of stronger salt or password_hash()
> and make 2nd parameter required for future release.
> - make crypt() use stronger default salt/hash w/o error
>
> Since password_hash() is supposed to do better job, first option seems
> better to me.
Deprecating it means it will be removed in the future.
Please leave the function alone. This should be solved with education,
not a gun to peoples head.
-Hannes