(PHP 5 >= 5.5.0)
password_needs_rehash — Checks if the given hash matches the given options
$hash
, string $algo
[, string $options
] )This function checks to see if the supplied hash implements the algorithm and options provided. If not, it is assumed that the hash needs to be rehashed.
hash
一个由 password_hash() 创建的散列值。
algo
一个用来在散列密码时指示算法的密码算法常量。
options
一个包含有选项的关联数组。目前支持两个选项：salt，在散列密码时加的盐（干扰字符串），以及cost，用来指明算法递归的层数。这两个值的例子可在 crypt() 页面找到。
Returns TRUE if the hash should be rehashed to match the given
algo and options, or FALSE
otherwise.
ydroneaud at opteya dot com (2013-06-21 17:11:31)
According to the documentation, it's checking if the given hashed password string is compatible with the provided algorithm (and options, but not salt), eg. it's checking if the hashed password string was generated with the provided algorithm (and options, but not salt).
There's nothing to 'rehash' in its parameters ... especially not the already hashed password string, and the password "stored" in the hashed password string is not supposed to be known, it's not in clear, it's a secret.
The name of the function seems misleading, this function should have been called "password_hash_compatible()" instead.
This function could be use to check if a password database/a hashed password string (hashed by function "password_hash()") need to be upgraded to a stronger password hashing/storage scheme: if the function returns false, a new password will have to be set for the user, hashed with the new, stronger, algorithm/options.
One should carefully think before using this function to support multiple algorithms/options in one database, eg. support "legacy scheme" passwords + "new scheme" ...