note 124189 added to function.password-hash

I believe a note should be added about the compatibility of crypt() and password_hash(). My tests showed that yes, password_verify can also take hashes generated by crypt - as well as those from password_hash. But vice versa this is not true... You cannot put hashes generated by password_hash into crypt for comparing them themselves, when used as the salt for crypt, as was recommended years ago (compare user entry with user crypt(userentry,userentry). No big deal, but it means that password checking routines MUST immediately be rewritten to use password_hash... You cannot start using password_hash for hash generation without also altering the password check routine! So the word "compatible" should be, IMHO, ammended with a word of caution, hinting the reader, that compatibility here is a one-way street. ---- Server IP: 212.124.37.9 Probable Submitter: 46.244.250.255 ---- Manual Page -- http://php.net/manual/en/function.password-hash.php Edit -- https://master.php.net/note/edit/124189 Del: integrated -- https://master.php.net/note/delete/124189/integrated Del: useless -- https://master.php.net/note/delete/124189/useless Del: bad code -- https://master.php.net/note/delete/124189/bad+code Del: spam -- https://master.php.net/note/delete/124189/spam Del: non-english -- https://master.php.net/note/delete/124189/non-english Del: in docs -- https://master.php.net/note/delete/124189/in+docs Del: other reasons-- https://master.php.net/note/delete/124189 Reject -- https://master.php.net/note/reject/124189 Search -- https://master.php.net/manage/user-notes.php