We are migrating an old website, which used pretty old password hashing to the new php password verify function. The old method used an old hash, and we would like to use password_verify
instead of the old method were just a hash and a salt was stored. The old hash algorithm was outdated, so we don't want to convert the old hash to the password_verify
structure (which might be possible).
Instead, we will block access and require an user to reset its password before continuing.
Question
Can we set the hash used in password_verify
to ""
(empty string) to block access to the account?