Everything
php
Learn Community Releases The PHP Project
Home » Project » RFCs » Change crypt() behavior w/o salt »

RFC: Change crypt() behavior w/o salt

Project Governance
Author
Yasuo Ohgaki
Target
5.6
crypt() without salt parameter produces too weak password hash. However, many users are using crypt() without salt parameter.

Mailing List Discussions


Change crypt behavior when salt parameter is omitted.

Overall Results

Generate strong salt by default
Generate E_NOTICE error
Keep current behavior (Use weak hash)
Generate strong salt by default
0 Votes (0%)
Generate E_NOTICE error
12 Votes (86%)
Keep current behavior (Use weak hash)
2 Votes (14%)

Voting Timeline

Dates based on UTC

Voting Breakdown

Generate strong salt by default

0 Votes (0%)

Generate E_NOTICE error

12 Votes (86%)

Keep current behavior (Use weak hash)

2 Votes (14%)