Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68423
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.169 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYpnryP9wMTO+BdE63wth6ERcLVP6t7D_8JJjLtTC0TKg@mail.gmail.com>
References: <CAGa2bXZPwU=MNS3gvcsQK6uEfdTsbk8K9OMX7Y4ZUOUFCJy8HA@mail.gmail.com>
	<5202AE51.3010005@sugarcrm.com>
	<CAGa2bXYpnryP9wMTO+BdE63wth6ERcLVP6t7D_8JJjLtTC0TKg@mail.gmail.com>
Date: Wed, 7 Aug 2013 21:22:36 -0700
Message-ID: <CADNQb0U6dXt22ky45DxWGJnyZRUfAxSHRoxN=fgJuowD_QQikA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] crypt() should raise error without 2nd parameter
From: hannes.magnusson@gmail.com (Hannes Magnusson)

On Wed, Aug 7, 2013 at 6:20 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi all,
>
> It seems there are 2 options for master branch when crypt()'s 2nd parameter
> is omitted.
>
>  - raise E_DEPRECIATED that advice use of stronger salt or password_hash()
>        and make 2nd parameter required for future release.
>  - make crypt() use stronger default salt/hash w/o error
>
> Since password_hash() is supposed to do better job, first option seems
> better to me.


Deprecating it means it will be removed in the future.

Please leave the function alone. This should be solved with education,
not a gun to peoples head.

-Hannes