What PHP 5.5 might look like

This is an interesting look into what features could be suggested for php 5.5

A simple API for password hashing

Status: proposed; Responsible: Anthony Ferrara

The recent password leaks (from LinkedIn etc) have shown that even large websites don’t get how to properly hash passwords. People have been advocating the use of bcrypt for years, but still most people seem to be using completely unsafe sha1 hashes.

We figured that the reason for this might be the really hard to use API of the crypt function. Thus we would like to introduce a new, simple API for secure password hashing:

<?php $password = "foo"; // creating the hash $hash = password_hash($password, PASSWORD_BCRYPT); // verifying a password if (password_verify($password, $hash)) { // password correct! } else { // password wrong! } 

The new hashing API comes with a few more features, which are outlined in the RFC.

(via nikic)