note 118640 added to function.password-verify

The function password_verify() uses constant time. This makes it safe against timing attacks. Don't use crypt($password_database) === crypt($password_given_by_login), since there is no protection against timing attacks! If you don't want to use password_verify(), then have a look at hash_equals(), which also runs a timing attack safe string comparison. ---- Server IP: 72.52.91.14 Probable Submitter: 79.206.153.74 ---- Manual Page -- http://php.net/manual/en/function.password-verify.php Edit -- https://master.php.net/note/edit/118640 Del: integrated -- https://master.php.net/note/delete/118640/integrated Del: useless -- https://master.php.net/note/delete/118640/useless Del: bad code -- https://master.php.net/note/delete/118640/bad+code Del: spam -- https://master.php.net/note/delete/118640/spam Del: non-english -- https://master.php.net/note/delete/118640/non-english Del: in docs -- https://master.php.net/note/delete/118640/in+docs Del: other reasons-- https://master.php.net/note/delete/118640 Reject -- https://master.php.net/note/reject/118640 Search -- https://master.php.net/manage/user-notes.php