[gregjor]

That's what I wrote -- sanitize before passing to the PHP password_hash function, which obviously happens on the server.