The md5 and shuffling of the md5 hash before doing a sha1 is entirely pointless. The salt generation looks acceptable though. The op stated that he already cr

The md5 and shuffling of the md5 hash before doing a sha1 is entirely pointless. The salt generation looks acceptable though. The op stated that he already created a system using bcrypt. The fact that op doesn't know what is wrong with Dave's code, and needs others to explain why Dave's code is bad, makes me lean towards op stfu and allow Dave to continue. Op is unlikely to be any more competent compared to the somewhat incompetent Dave. I agree that it is likely that op and Dave are one and the same, and think this mess of code is some sort of genius.