I'm using phpass (bcrypt) to hash the password and SSL when it's transmitted, and using PDO (with PHP) to stop injections, is it worth padding the password, so that if the user enters "123456" as the password before it's hashed a prefix and/or suffix are added, so for example
(prefix "abcZYX" and suffix "£%$£@&$%")
which is then salted and hashed.
the prefix and suffix could be the same or different for every password
or could it be better to require minimum lengths and combinations
Must be at least 10 characters, and have a capital letter, number and symbol
Or is it better to just hash and salt the password?