For some reason the documentation does not mention this, but if you succeed in sending the null byte character to password_hash with the default Bcrypt algortihm, PHP with exit the application with a ValueError.
Normally the browser will encode the input, but you can force the issue using e.g. cURL:
printf "password=foo\0bar" | curl -X POST --data-binary @- https://example.com -H "Content-Type: application/x-www-form-urlencoded"
How do you deal with this issue?
Do you replace null byte characters or use e.g. the Argon2id algorithm to get around this problem?