How and Why to Hash Passwords in PHP
phpsec.org
How and Why to Hash Passwords in PHP
1–4 of 4 posts
Re: How and Why to Hash Passwords in PHP
#2yikes, a php security site telling people to use sha1().
don't use sha1 hashes for storing passwords, use bcrypt. http://www.openwall.com/phpass/
or a quick code snippet:
for ($salt = "", $x = 0; $x++ Re: How and Why to Hash Passwords in PHP
#3I hope this article is really old...at least then the author can claim ignorance.
phpsec should update this article with a more secure example.
Re: How and Why to Hash Passwords in PHP
#4Well, bonus points for including SQL that doesn't suffer from SQL injection issues, but every one of the suggestions is wrong.
I'm personally confused by this comment:
Note: Using MySQL's password() function in your own applications isn't recommended - the algorithm used has changed over time and prior to 4.1 was particularly weak.