PHP password_needs_rehash() Function
PHP Password Hashing Algorithm
The password_hash() function is used to check if the hash value matches the specified options.
PHP Version Requirement: PHP 5 >= 5.5.0, PHP 7
Syntax
bool password_needs_rehash ( string $hash , int $algo [, array $options ] )
Parameter Description:
hash: A hash value created by password_hash().
algo: A password algorithm constant indicating the algorithm to use when hashing the password.
options: An associative array containing options. Currently, two options are supported: salt, which is the salt (interference string) added when hashing the password, and cost, which indicates the number of algorithm recursions. Examples of these values can be found on the crypt() page.
If omitted, a random salt value and default cost will be used.
Return Value
This function checks if the specified hash value implements the provided algorithm and options. If not, it requires rehashing.
Example
password_needs_rehash() Usage
<?php
$password = 'rasmuslerdorf';
$hash = '$2y$10$YCFsG6elYca568hBi2pZ0.3LDL5wjgxct1N8w/oLR/jfHsiQwCqTS';
// The cost parameter can be adjusted when hardware performance improves
$options = array('cost' => 11);
// Verify the stored hash against the plain text password
if (password_verify($password, $hash)) {
// Check if there are newer available hashing algorithms
// or if the cost has changed
if (password_needs_rehash($hash, PASSWORD_DEFAULT, $options)) {
// If so, create a new hash and replace the old one
$newHash = password_hash($password, PASSWORD_DEFAULT, $options);
}
// Log the user in
}
?>