The following demonstrates the problem with automtic salt crypt() function. Note: There is a different behaviour here between 4.0.1pl2 and 4.0.2 not sure what can be considered correct.

<?php

$orgstr="abc123";
$cryptstr=crypt($orgstr);

echo "orgstr=$orgstr, cryptstr=$cryptstr<p>";
echo "Salt length=".CRYPT_SALT_LENGTH."<p>";

?>

This will return the same $cryptstr no matter how many times you call the script. It seems like the automatic salt isn't generated for each call of crypt(). Not sure what the real behavious should be but it's diffrent from 4.0.1pl2 (My machine will use a DES crypt() so that the salt length is 2.)