note 118603 added to function.password-hash

Please note that password_hash will ***truncate*** the password at the first NULL-byte. http://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html If you use anything as an input that can generate NULL bytes (sha1 with raw as true, or if NULL bytes can naturally end up in people's passwords), you may make your application much less secure than what you might be expecting. The password $a = "\01234567"; is zero bytes long (an empty password) for bcrypt. The workaround, of course, is to make sure you don't ever pass NULL-bytes to password_hash. ---- Server IP: 72.52.91.14 Probable Submitter: 80.122.206.130 ---- Manual Page -- http://php.net/manual/en/function.password-hash.php Edit -- https://master.php.net/note/edit/118603 Del: integrated -- https://master.php.net/note/delete/118603/integrated Del: useless -- https://master.php.net/note/delete/118603/useless Del: bad code -- https://master.php.net/note/delete/118603/bad+code Del: spam -- https://master.php.net/note/delete/118603/spam Del: non-english -- https://master.php.net/note/delete/118603/non-english Del: in docs -- https://master.php.net/note/delete/118603/in+docs Del: other reasons-- https://master.php.net/note/delete/118603 Reject -- https://master.php.net/note/reject/118603 Search -- https://master.php.net/manage/user-notes.php