note 113397 added to function.password-hash

I agree with martinstoeckli, don't create your own salts unless you really know what you're doing. By default, it'll use /dev/urandom to create the salt, which is based on noise from device drivers. And on Windows, it uses CryptGenRandom(). Both have been around for many years, and are considered secure for cryptography (the former probably more than the latter, though). Don't try to outsmart these defaults by creating something less secure. Anything that is based on rand(), mt_rand(), uniqid(), or variations of these is *not* good. ---- Server IP: 80.64.47.13 Probable Submitter: 84.124.14.66 ---- Manual Page -- http://php.net/manual/en/function.password-hash.php Edit -- https://master.php.net/note/edit/113397 Del: integrated -- https://master.php.net/note/delete/113397/integrated Del: useless -- https://master.php.net/note/delete/113397/useless Del: bad code -- https://master.php.net/note/delete/113397/bad+code Del: spam -- https://master.php.net/note/delete/113397/spam Del: non-english -- https://master.php.net/note/delete/113397/non-english Del: in docs -- https://master.php.net/note/delete/113397/in+docs Del: other reasons-- https://master.php.net/note/delete/113397 Reject -- https://master.php.net/note/reject/113397 Search -- https://master.php.net/manage/user-notes.php