The `$user['password']` here is the plain text value submitted from the login form, and as such, will never contain the encryption value. This is a bug that was pointed out to my by the creator of JFB Connect while I was talking to him at JWC. It needs to check

```php
if (strpos($instance->password, '{'.strtoupper($encryption).'}') === false)
```

Also, I'm not so sure about storing the encryption type in the hashed password as you are suggesting. The `$2y$` _is_ the encryption type - http://php.net/manual/en/function.password-hash.php - Storing it in the way you're suggesting is very non-standard, IMO.