php encrypt/decrypt function using salt - how to?

Question

I am using php for a basic application to login into the system, be able to edit account information, and delete account. I have a mysql database. I need to encrypt/decrypt password using salt. How do I do it? Just need to make sure data is secure.

Answer 1

You don't want to encrypt passwords. You want to hash them.

Some reading: http://php.net/manual/en/faq.passwords.php

Related SO post: how to hash the password and get it back

Answer 2

Passwords should be hashed, in contrast to encryption this is a one-way function, that should make it impossible to get back the original password.

1. Store only the hash-value in the database, and compare against this value for login.
2. Use a unique salt per password, it can be stored plaintext in the same database field as your hash-value.
3. Use a slow key-derivation function like Bcrypt, to prevent brute-force attacks.

It's recommended to use a well established library like phpass to build the hashes. For further reading have a look at this tutorial.