So, i learned that new in PHP 5.5 is password-hash() which works much like crypt(). Which is more secure (slower) than md5() or sha1(). The result string is algo+hash+salt, which can be passed as-is to password-verify() to verify password. So far i get how it works.
Some doomsday questions that remain:
Q1) What is the name of the result format/protocol/convention?
Q2) What i dont get however, is that all of the salt is included in the database. If a badguy® where to obtain these, he has all the puzzle parts. In the past, i learned to put (part of) the salt outside of the database: in source, of even base it on ram/system/hardware values so its not even on disk. Why is this not facilitated, or how should i? Ofcourse i could do a double hash with a different salt, or is there a better way?
Q3) Also -in the doomsday mindset that security requires- i believe the single-point of failure password_hash() is going to be a high value target, and might facilitate MITM attacks way easier than the more self-contained crypt(). I imagine writing a "bad" algo and setting it as the PASSWORD_DEFAULT algo would be easier than altering crypt(). I have not looked into the PHP backend code/modules however, just speculating.
Considerations welcome. Accepted answer will be the one that gets most up-votes/census for questions 2/3 within a week at most, and has question 1 verifiable correct.