password-hash.sh is hardcoded to use "/usr/bin/php"

That is interesting - the Drupal 8 version has #!/usr/bin/env php but the Drupal 7 version says:

 * Check for your PHP interpreter - on Windows you'll probably have to
 * replace line 1 with
 *   #!c:/program files/php/php.exe

I wonder if that is for a reason.

#29706: More secure password hashing

It will be easy for a novice to create this patch.

It should have been backported in #2108573: password-hash.sh is broken, but let's fix it here.

Being an interested novice I will put together a patch for this now... brb :)

I back-ported the same change from the D8 core, the only line changed here is the php env declaration at the top of the password-hash.sh file.

@epophoto Nice work!

Committed to 7.x - thanks!