We are migrating an old website, which used pretty old password hashing to the new php password verify function. The old method used an old hash, and we would like to use
password_verify instead of the old method were just a hash and a salt was stored. The old hash algorithm was outdated, so we don't want to convert the old hash to the
password_verify structure (which might be possible).
Instead, we will block access and require an user to reset its password before continuing.
Can we set the hash used in
"" (empty string) to block access to the account?