如果我使用损坏的参数调用password_verify（）会发生什么？

Question

According to its documentation PHP's password_verify() function

Returns TRUE if the password and hash match, or FALSE otherwise. [highlight added by me]

The documentation also indicates that the functions parameters are:

password The user's password.

hash A hash created by password_hash().

The documentation does not provide any insight about errors/exceptions/warning with respect to cases in which those parameters are "corrupted" or invalid.

Some quick testing showed me that the question is rather tolerant with regard to "garbage" being passed in (especiallty in the hash parameter). My question is if I can rely on this behavior, as it would be somewhat implied in the "Returns[...]or FALSE otherwise" part?

Answer 1

For PHP document: if no exception/error/warning is mentioned, then there will be no exception/error/warning. If you meet an exception without any document, it is a BUG in the document, and you can report it to the PHP team to fix it. So writing a clean if (!password_verify(...)) is OK.

For password_verify: it is meaningless to distinguish invalid hash or wrong password for password verification, so password_verify just returns false if the hash doesn't match the password. Such behavior makes programming easier.