title: Comparing passwords with crypt() in PHP
body: <p>I need to get the basics of this function. The php.net documentation states, for the blowfish algorithm, that: </p>
  
  <blockquote>
    <p>Blowfish hashing with a salt as follows: "$2a$", a two digit cost parameter, "$", and 22 base 64 digits from the alphabet "./0-9A-Za-z". Using characters outside of this range in the salt <em>will cause crypt() to return a zero-length string</em></p>
  </blockquote>
  
  <p>So this, by definition, should not work:</p>
  
  <pre><code>echo crypt('rasmuslerdorf', '$2a$07$usesomadasdsadsadsadasdasdasdsadesillystringforsalt$');
  </code></pre>
  
  <p>However, it spits out:</p>
  
  <pre><code>$2a$07$usesomadasdsadsadsadaeMTUHlZEItvtV00u0.kb7qhDlC0Kou9e
  </code></pre>
  
  <p>Where it seems that crypt() has cut the salt itself to a length of 22. Could somebody please explain this?</p>
  
  <p>Another aspect of this function I can't get my head around is when they use crypt() to compare passwords. <a href="http://php.net/manual/en/function.crypt.php" rel="noreferrer">http://php.net/manual/en/function.crypt.php</a> (look at ex. #1). Does this mean that if I use the same salt for all encrypting all my passwords, I have to crypt it first? ie:</p>
  
  <pre><code>$salt = "usesomadasdsadsadsadae";
  $salt_crypt = crypt($salt);
  
  if (crypt($user_input, $salt) == $password) {
     // FAIL WONT WORK
  }
  
  if (crypt($user_input, $salt_crypt) == $password) {
     // I HAVE TO DO THIS?
  }    
  </code></pre>
  
  <p>Thanks for your time</p>