note 100769 added to function.crypt

It seem that this function has the same security problem as the LM encryption in windows XP where you only have to crack the first 8 characters. Some comment have mentionned it already, but here a really clear example that illustrate the situation: <?php $user = 'username'; $pass = 'thisismylongpassword'; for($i=1;$i<=strlen($pass);$i++) echo crypt(substr($pass, 0, $i), $user) . ' - ' . substr($pass, 0, $i) . '<br>'; ?> Here's the result: usWV5iQ2lF6wU - t usFyQOx58wzek - th useskTjnZElpE - thi usJhkSkD0WfCI - this usHhCeL6bIVpY - thisi usBZjSWdjcz9M - thisis usp4N0rk4kv7w - thisism usKlq9t5QnOQo - thisismy usKlq9t5QnOQo - thisismyl usKlq9t5QnOQo - thisismylo usKlq9t5QnOQo - thisismylon usKlq9t5QnOQo - thisismylong usKlq9t5QnOQo - thisismylongp usKlq9t5QnOQo - thisismylongpa usKlq9t5QnOQo - thisismylongpas usKlq9t5QnOQo - thisismylongpass usKlq9t5QnOQo - thisismylongpassw usKlq9t5QnOQo - thisismylongpasswo usKlq9t5QnOQo - thisismylongpasswor usKlq9t5QnOQo - thisismylongpassword So basicaly, the password get truncated here: thisismy<here>longpassword Everything over 8 characters is dismissed. ---- Server IP: 69.147.83.197 Probable Submitter: 24.37.122.45 ---- Manual Page -- http://www.php.net/manual/en/function.crypt.php Edit -- https://master.php.net/note/edit/100769 Del: integrated -- https://master.php.net/note/delete/100769/integrated Del: useless -- https://master.php.net/note/delete/100769/useless Del: bad code -- https://master.php.net/note/delete/100769/bad+code Del: spam -- https://master.php.net/note/delete/100769/spam Del: non-english -- https://master.php.net/note/delete/100769/non-english Del: in docs -- https://master.php.net/note/delete/100769/in+docs Del: other reasons-- https://master.php.net/note/delete/100769 Reject -- https://master.php.net/note/reject/100769 Search -- https://master.php.net/manage/user-notes.php