Use hash_hmac() rather than crypt() to generate hash.

PHP crypt() function uses only the first two characters of the salt and the first eight characters of the data - the latter of which may be predictable as it is a serialized PHP object, array, etc. The verification function could be vastly improved by using instead the hash_hmac() function (available in PHP 5.1.2 and later) which uses all of the data and all of the key to generate the hash.