note 115727 added to function.password-needs-rehash

Some other use-cases for the password_needs_rehash function is when you have specified using the PASSWORD_DEFAULT algorithm for password_hash. As mentioned on the Password Hashing Predefined Constants and password_hash pages, the algorithm used by PASSWORD_DEFAULT is subject to change as different versions of PHP are released. Additionally password_needs_rehash would be used if you have changed the optional cost or static salt (DO NOT USE A STATIC SALT) requirements of your password_hash options. Full example: <?php $new = [ 'options' => ['cost' => 11], 'algo' => PASSWORD_DEFAULT, 'hash' => null ]; $password = 'rasmuslerdorf'; //stored hash of password $oldHash = '$2y$07$BCryptRequires22Chrcte/VlQH0piJtjXl.0t1XkA8pw9dMXTpOq'; //verify stored hash against plain-text password if (true === password_verify($password, $oldHash)) { //verify legacy password to new password_hash options if (true === password_needs_rehash($oldHash, $new['algo'], $new['options'])) { //rehash/store plain-text password using new hash $newHash = password_hash($password, $new['algo'], $new['options']); echo $newHash; } } ?> The above example will output something similar to: $2y$11$Wu5rN3u38.g/XWdUeA6Wj.PD.F0fLXXmZrMNFyzzg2UxkVmxlk41W ---- Server IP: 72.52.91.14 Probable Submitter: 73.53.146.202 ---- Manual Page -- http://php.net/manual/en/function.password-needs-rehash.php Edit -- https://master.php.net/note/edit/115727 Del: integrated -- https://master.php.net/note/delete/115727/integrated Del: useless -- https://master.php.net/note/delete/115727/useless Del: bad code -- https://master.php.net/note/delete/115727/bad+code Del: spam -- https://master.php.net/note/delete/115727/spam Del: non-english -- https://master.php.net/note/delete/115727/non-english Del: in docs -- https://master.php.net/note/delete/115727/in+docs Del: other reasons-- https://master.php.net/note/delete/115727 Reject -- https://master.php.net/note/reject/115727 Search -- https://master.php.net/manage/user-notes.php