Rely on checking for PASSWORD_DEFAULT, which should ALWAYS be available.

Since this is supposed to be forward compatible.  What happens if BCRYPT is pulled one day for any reason?  This would break forward compatibility, but relying on PASSWORD_DEFAULT should be safe.

I think another option would be:

if ( ! function_exists('password_hash') ) {
}

1 files changed, 1 insertions, 1 deletions

diff --git a/lib/password.php b/lib/password.php
index 4d0e8b7..faa5eaa 100644
--- a/lib/password.php
+++ b/lib/password.php
@@ -7,7 +7,7 @@
  * @copyright 2012 The Authors
  */
 
-if (!defined('PASSWORD_BCRYPT')) {
+if (!defined('PASSWORD_DEFAULT')) {
 
     define('PASSWORD_BCRYPT', 1);
     define('PASSWORD_DEFAULT', PASSWORD_BCRYPT);