altered to use password_verify()/password_hash()

These are much simpler to use password hashing and verification methods that support blowfish encryption. The only reason I would see to not use them is if server is using a php version < 5.5.0.
Result of password_hash() is a 60-char string, using a random salt and default cost of 10.

See: http://php.net/manual/en/function.password-hash.php