3 ms·
How and Why to Hash Passwords in PHP
- there 15y agoyikes, a php security site telling people to use sha1(). don't use sha1 hashes for storing passwords, use bcrypt. http://www.openwall.com/phpass/ http://www.openwall.com/phpass/ or a quick code snippet: for ($salt = "", $x = 0; $x++ < 40; $salt .= chr(mt_rand(0,255))) ; $hashed = crypt($password, '$2a$08$' . hash("whirlpool", $salt));
- joshrice 15y agoI hope this article is really old...at least then the author can claim ignorance. phpsec should update this article with a more secure example.
- devicenull 15y agoWell, bonus points for including SQL that doesn't suffer from SQL injection issues, but every one of the suggestions is wrong. I'm personally confused by this comment: Note: Using MySQL's password() function in your own applications isn't recommended - the algorithm used has changed over time and prior to 4.1 was particularly weak. So.. if you know it's not recommended, why even include an example of it?