note 118576 added to function.password-hash

Pay close attention to the maximum allowed length of the password parameter! If you exceed the maximum length, it will be truncated without warning. If you prepend your own salt/pepper to the password, and that salt/pepper exceeds the maximum length, then this function will truncate the actual password. That means password_verify() will return true with ANY password using the same salt/pepper. It might be a good idea to append any salt/pepper to the end of the password instead. ---- Server IP: 72.52.91.14 Probable Submitter: 50.5.107.207 ---- Manual Page -- http://php.net/manual/en/function.password-hash.php Edit -- https://master.php.net/note/edit/118576 Del: integrated -- https://master.php.net/note/delete/118576/integrated Del: useless -- https://master.php.net/note/delete/118576/useless Del: bad code -- https://master.php.net/note/delete/118576/bad+code Del: spam -- https://master.php.net/note/delete/118576/spam Del: non-english -- https://master.php.net/note/delete/118576/non-english Del: in docs -- https://master.php.net/note/delete/118576/in+docs Del: other reasons-- https://master.php.net/note/delete/118576 Reject -- https://master.php.net/note/reject/118576 Search -- https://master.php.net/manage/user-notes.php