note 118640 deleted from function.password-verify by salathe

Note Submitter: chris at weeone dot de ---- The function password_verify() uses constant time. This makes it safe against timing attacks. Don't use crypt($password_database) === crypt($password_given_by_login), since there is no protection against timing attacks! If you don't want to use password_verify(), then have a look at hash_equals(), which also runs a timing attack safe string comparison.