Description:
------------
---
From manual page: http://www.php.net/function.password-verify
---
The documentation for the hash_verify() function (http://php.net/manual/en/function.hash-equals.php) clearly states that it is a "Timing attack safe string comparison".

The documentation for password_verify() should indicate whether it is or is not vulnerable to timing based attacks.