if (!password_verify($userSuppliedPW, $storedString)) {
// bail out, user supplied wrong pass
}
if (password_needs_rehash($storedString, PASSWORD_DEFAULT)) {
$newHash = password_hash($userSuppliedPW, PASSWORD_DEFAULT);
// update stored string to $newHash
}