What the blog poster probably means is that you should hash the provided password when the user tries to log in, and you will have to do that hash for every login attempt, since the server stores only the hash.
It is possible, but not probable, that the author really meant to change the salt and recompute a new hash upon each login, which would be kinda stupid, explaining why I deem that "improbable". But hey, this is the Internet, anything can happen.
The blog post is partially right. Yes, you need a slow and salted hash. But no, a homemade loop of hashing cannot be condoned. Cryptographic algorithms must not be improvised; homemade is bad. What must be used is a well-vetted construction which has been inspected by many cryptographers over a long time. See this answer for details on the usual solutions. In PHP, this means using the
crypt() function with the
(Apart from the necessity of using standard constructions, it is also important to use a fast implementation, since the whole concept of slow hashing is a muscle contest between the attacker's machine and the defender's machine. Using PHP standard functions allows for accessing native code implementations, which will be much more efficient than anything written in PHP.)