Showing posts with label crytography. Show all posts
Showing posts with label crytography. Show all posts

PHP Cryptography, Storing Passwords

Friday, February 13, 2009

Storing cleartext password in database is the worst idea, instead, you should store the hash of the password and use a salt for even best results.

<?php
 /*$password contains the password*/
 $salt = 'SHIFTLEFT';
 $passwordHash = md5($salt.md5($password.$salt));
 
 /* insert the $passwordHash to database */
?>


And to check whether user input the correct password, hash the provided password using the same technique, and compare them.
<?php
 $userPass = $_POST['password'];
 $salt = 'SHIFTLEFT';
 $passwordHash = md5($salt.md5($userPass).$salt);

 /*compare $passwordHash with password stored in database*/

?>


Hope it helps.