note 112496 added to function.password-needs-rehash

According to the documentation, it's checking if the given hashed password string is compatible with the provided algorithm (and options, but not salt), eg. it's checking if the hashed password string was generated with the provided algorithm (and options, but not salt). There's nothing to 'rehash' in its parameters ... especially not the already hashed password string, and the password "stored" in the hashed password string is not supposed to be known, it's not in clear, it's a secret. The name of the function seems misleading, this function should have been called "password_hash_compatible()" instead. This function could be use to check if a password database/a hashed password string (hashed by function "password_hash()") need to be upgraded to a stronger password hashing/storage scheme: if the function returns false, a new password will have to be set for the user, hashed with the new, stronger, algorithm/options. One should carefully think before using this function to support multiple algorithms/options in one database, eg. support "legacy scheme" passwords + "new scheme" ... ---- Server IP: 195.221.21.36 Probable Submitter: 2001:4b98:dc0:45:216:3eff:feee:d056 ---- Manual Page -- http://php.net/manual/en/function.password-needs-rehash.php Edit -- https://master.php.net/note/edit/112496 Del: integrated -- https://master.php.net/note/delete/112496/integrated Del: useless -- https://master.php.net/note/delete/112496/useless Del: bad code -- https://master.php.net/note/delete/112496/bad+code Del: spam -- https://master.php.net/note/delete/112496/spam Del: non-english -- https://master.php.net/note/delete/112496/non-english Del: in docs -- https://master.php.net/note/delete/112496/in+docs Del: other reasons-- https://master.php.net/note/delete/112496 Reject -- https://master.php.net/note/reject/112496 Search -- https://master.php.net/manage/user-notes.php