password_hash replaces the salt you were generating

Hand-rolled password storage gets the same three things wrong every time: a hash designed to be fast, a salt in its own column that is reused or truncated, and a comparison that returns as soon as two bytes differ. PHP 5.5 puts all of it behind two functions, and the salt stops being something the application owns at all.

final class PasswordHasher
{
    const COST = 11;

    public function hash($plain)
    {
        return password_hash($plain, PASSWORD_BCRYPT, array('cost' => self::COST));
    }

    public function matches($plain, $stored)
    {
        return password_verify($plain, $stored);
    }

    public function stale($stored)
    {
        return password_needs_rehash($stored, PASSWORD_BCRYPT, array('cost' => self::COST));
    }
}

// stored value: $2y$11$rTn0uZ...  — algorithm, cost and salt, 60 characters

The algorithm, the cost and the salt all live inside the returned string, so there is no second column and no decision left to get wrong. password_needs_rehash() is the part that gets skipped: raising the cost later only affects new accounts unless you rehash on a successful login, which is the one moment the plaintext is legitimately in hand. Two practical notes. Make the column 255 characters even though bcrypt produces 60, because PASSWORD_DEFAULT is explicitly allowed to change. And if the server is still on 5.3 or 5.4, ircmaxell/password-compat is the same API implemented over crypt(), so the calling code does not change when the server finally does.