note 118576 deleted from function.password-hash by cmb
| From: | cmb@php.net | Date: | Sun, 24 May 2020 10:40:55 +0000 |
| Subject: | note 118576 deleted from function.password-hash by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-214669@lists.php.net to get a copy of this message | ||
Note Submitter: anonymous
----
Pay close attention to the maximum allowed length of the password parameter! If you exceed the
maximum length, it will be truncated without warning.
If you prepend your own salt/pepper to the password, and that salt/pepper exceeds the maximum
length, then this function will truncate the actual password. That means password_verify() will
return true with ANY password using the same salt/pepper.
It might be a good idea to append any salt/pepper to the end of the password instead.