Modern password practices

[txtsd]

1. Use password_hash() instead of crypt()
   From the crypt page: password_hash() uses a strong hash, generates a strong salt, and applies proper rounds automatically. password_hash() is a simple crypt() wrapper and compatible with existing password hashes. Use of password_hash() is encouraged.
   Ideally, use it with Argon instead of bcrypt since the latter truncates passwords to 72 chars.

2. Do not set a max password length.
   Or at the very least, set it to a sane number. 20 is ridiculously small, and subject to ridicule. 64 should be the smallest max length one should consider.