[kh99]

I'm not really an expert on password algorithms, but my understanding is that a salt value is randomly generated at some point (like whenever the password is changed), but of course you need to save the salt as well as the hashed password to be able to validate a password. So you're right, it isn't generated randomly every time you check a password. But as I mentioned above, the password_hash() function (and the crypt() function it's based on) return a string that includes the hash algorithm, the iteration count, and the salt (in addition to the hashed password), so you really only need to save the one string that is returned, and when you use password_verfiy() to check a password, that string will contain all the necessary information.

It might help to study the examples for password_hash() and crypt() in the php manual.

Edit: cellarius posted while I was writing, didn't mean to repeat what he said.