Q:

How many possible randomly generated salts could be generated using PHP's password_hash() function?

I have two questions here:
1) How many possible randomly generated salts could be generated using PHP's password_hash() function?
2) According to php.net it states that the return value is a contains "the algorithm used, the cost and salt are returned as part of the hash" and I assume the hash itself. So from my understanding in a returned string of $2y$10$x27FUiXA/hFKjD7NDxyD6e63ac4gmCkTqXRpmy1Rk.MxXAqRd8yO6 the 2y indicates the algorithm, the 10 indicates the cost, but which characters indicate the salt and which characters indicate the hash?

A:

1) The salt for password_hash() is a 128 bit salt which is the first 22 base64 characters after the cost factor. In your example, the salt would be x27FUiXA/hFKjD7NDxyD6e. Because it is 128 bit, you can calculate the number of potential salts as 2^128 which is 3.4028237e+38. So, in short, a lot.
2) Well this didn't seem like a question so i'll try to answer the "which characters indicate the hash" part. The hash are the remaining 31 characters after the salt. In your case 63ac4gmCkTqXRpmy1Rk.MxXAqRd8yO6. 
(also, your understanding is correct. 2y is the algorithm, and 10 is the cost.)

It is important to note that password_hash() can change its implementation to use a different algorithm if you update PHP to a newer version that changes it. 

PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). Note that this constant is designed to change over time as new and stronger algorithms are added to PHP.

If you use PASSWORD_BCRYPT it will always use bcrypt.

