0

I am led to believe MD5 and SHA1 aren't the best practices for dealing with passwords, therefore I want to make sure I am doing things in the most secure manner.

I don't know how to implement this, I was given a site from another "Developer" who has stored the passwords in plain text... which is why I am correcting it now.

My understanding is:

  • User registers for X and enters their desired password to login at a later date.

  • The details entered are submitted to a database. The password is submitted and Hashed server side, then salted.

  • When the user next logs in, the password is then re hashed and compared with the entry in the existing database. If the password is correct then access is granted.

My current setup is PHP, with PHP My Admin managing the database.

Do I:

Want a separate table/database for the hashed/salted passwords? Is there an existing function in PHP I can use to hash passwords? Is it necessary to hash, salt then pepper passwords?

Thank you, I am new to PHP and want to make sure this information is kept securely"

FK-
  • 1,462
  • 1
  • 10
  • 17
snipar
  • 31
  • 1
  • 1
  • 7
  • 2
    Use this for php > 5.5 http://php.net/manual/en/function.password-hash.php You dont need a separate table,for lower version use https://github.com/ircmaxell/password_compat – Mihai May 24 '15 at 16:08
  • possible duplicate of [How do you use bcrypt for hashing passwords in PHP?](http://stackoverflow.com/questions/4795385/how-do-you-use-bcrypt-for-hashing-passwords-in-php) – martinstoeckli May 25 '15 at 19:27

2 Answers2

2

PHP v5.5 provided a build in functions to authorization. Read about:

password_hash() and password_verify()

It's better to use verified components than created them by your own - especially an authorization process. Broken authorization is one of the main vulnerabilities!

Adam S.
  • 145
  • 7
0

you simply do:

 <?php
 $password = md5($_POST['password']); // or md5($_GET['password'])
  // insert into the database

then to compare on login its the same process

 $password = md5($_POST['password']);
 $login = "select username from users where password = '".$password."'";

Done :)

Adrian Brown
  • 79
  • 1
  • 8
  • No this you should not do, because MD5 is ways too fast ([9 Giga MD5/s](http://hashcat.net/oclhashcat/#performance)), and therefore can be brute-forced too easily. – martinstoeckli May 25 '15 at 19:23