PHP developers sometimes need to check whether a sodium password hash uses outdated work parameters. This comes up when preparing data, displaying results, or integrating information with other services.
The sodium_crypto_pwhash_str_needs_rehash() operation handles this particular task. The following examples show its result, its limitations, and a practical way to apply it.
What Is sodium_crypto_pwhash_str_needs_rehash() in PHP?
Check whether a sodium password hash uses outdated work parameters.
Its syntax is:
sodium_crypto_pwhash_str_needs_rehash(string $password_hash, int $opslimit, int $memlimit): bool
The syntax shows the expected parameters and return type. Arguments marked with an ampersand are passed by reference and may be modified. Optional parameters control additional behavior; values must match the declared types.
Important: Call only after successful password verification, then generate and persist a new hash. The function does not perform rehashing itself.
Parameters:
$password_hash— A named input or configuration argument; use the declared type and optional default shown above.$opslimit— A named input or configuration argument; use the declared type and optional default shown above.$memlimit— A named input or configuration argument; use the declared type and optional default shown above.
Example 1: Basic Usage
This first example uses a small input to demonstrate the main result of sodium_crypto_pwhash_str_needs_rehash().
<?php
$hash = sodium_crypto_pwhash_str("secret", SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE, SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE); var_dump(sodium_crypto_pwhash_str_needs_rehash($hash, SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE, SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE));
Output: The result depends on an installed extension, an existing file, database records, or a randomly selected order. The code is an illustrative example and requires the environment described below.
The output demonstrates the primary operation: check whether a sodium password hash uses outdated work parameters.
Example 2: Understanding Another Case
This second example changes the input or option to reveal a different behavior of sodium_crypto_pwhash_str_needs_rehash().
<?php
$hash = sodium_crypto_pwhash_str("secret", SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE, SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE); var_dump(sodium_crypto_pwhash_str_needs_rehash($hash, SODIUM_CRYPTO_PWHASH_OPSLIMIT_MODERATE, SODIUM_CRYPTO_PWHASH_MEMLIMIT_MODERATE));
Output: The result depends on an installed extension, an existing file, database records, or a randomly selected order. The code is an illustrative example and requires the environment described below.
Compared with the first example, this one illustrates the same operation with a different input shape or option. Call only after successful password verification, then generate and persist a new hash. The function does not perform rehashing itself.
Practical Example: A Real Application Scenario
Here is a practical use of sodium_crypto_pwhash_str_needs_rehash() with realistic sample information. Adapt the values to match your application.
<?php
$password = "sample"; $hash = sodium_crypto_pwhash_str($password, SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE, SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE); if (sodium_crypto_pwhash_str_verify($hash, $password) && sodium_crypto_pwhash_str_needs_rehash($hash, SODIUM_CRYPTO_PWHASH_OPSLIMIT_MODERATE, SODIUM_CRYPTO_PWHASH_MEMLIMIT_MODERATE)) { echo "Upgrade hash after login"; }
Output: The result depends on an installed extension, an existing file, database records, or a randomly selected order. The code is an illustrative example and requires the environment described below.
This is a useful starting point, but production code should check errors and validate values before performing the operation. Call only after successful password verification, then generate and persist a new hash. The function does not perform rehashing itself.
Important Behavior and Edge Cases
Call only after successful password verification, then generate and persist a new hash. The function does not perform rehashing itself.
- Input: Use the expected PHP types and validate user-provided values.
- Result: Check the return value separately from any modifications to the input.
- Environment: For extension, database, or filesystem examples, verify availability and handle failures before accessing results.
Comparison With Related Functions
| Function or Approach | When to Use It |
|---|---|
sodium_crypto_pwhash_str_needs_rehash() | Check whether a sodium password hash uses outdated work parameters. |
| Related functions | password_needs_rehash() is the password_hash API counterpart. |
Common Beginner Mistakes
| Mistake | Correct Approach |
|---|---|
| Storing plaintext passwords | Store only password hashes with suitable work factors; never log raw passwords. |
| Using incompatible hash formats | password_needs_rehash() is the password_hash API counterpart. |
| Confusing password verification with rehashing | Call only after successful password verification, then generate and persist a new hash. The function does not perform rehashing itself. |
Key Takeaways
sodium_crypto_pwhash_str_needs_rehash()lets you check whether a sodium password hash uses outdated work parameters.- Call only after successful password verification, then generate and persist a new hash. The function does not perform rehashing itself.
- password_needs_rehash() is the password_hash API counterpart.
- Check input, return values, and environmental requirements when adapting the examples.
sodium_crypto_pwhash_str_needs_rehash() provides a focused PHP operation for check whether a sodium password hash uses outdated work parameters. Start with the simple examples, then adapt the practical example with the correct checks for your project.