title: PHP password_hash(), default or custom salt?
body: <p>I am thinking of using password_hash() function to encrypt user passwords. I understand that this function generates salt by default if you don't provide it, and it is even encouraged to use the default salt instead of your own. I am currently weighing in 3 options and can't decide which one to go with so I'd appreciate it if you could help me out.</p>
  
  <p><strong>1. option: password_hash() with default salt</strong></p>
  
  <pre><code>$passwordInput = $_POST['password'];
  $passwordHash = password_hash($passwordInput, PASSWORD_BCRYPT);
  //INSERT $passwordHash INTO DATABASE
  </code></pre>
  
  <p><strong>2. option: password_hash() with custom salt</strong></p>
  
  <pre><code>$options = ['salt' =&gt; mcrypt_create_iv(22, MCRYPT_DEV_URANDOM)];
  $passwordInput = $_POST['password'];
  $passwordHash = password_hash($passwordInput, PASSWORD_BCRYPT, $options);
  //INSERT $passwordHash INTO DATABASE
  </code></pre>
  
  <p><strong>3. option: not using password_hash() at all</strong></p>
  
  <p>I am basing this option on a post from 2014: <a href="https://stackoverflow.com/questions/549/the-definitive-guide-to-form-based-website-authentication?rq=1">The definitive guide to form-based website authentication</a>. Basically if it is a more secure approach than password_hash() I'd use something like this:</p>
  
  <pre><code>$salt = uniqid(rand(0, 1000000);
  $passwordInput = $_POST['password'];
  $password = hash('sha512', $salt . $passwordInput);
  //INSERT $password AND $salt INTO DATABASE SEPARATELY
  </code></pre>