Storing passwords in php 5

You have just created a system where a user needs to login with some type of username/password combo and you need to store the password.How do you safely go about doing this?

Software >> PHP Programming

  Print this    Email this

Storing passwords in php 5

This topic is something that every php programmer will have to deal with at some point in their programming career. You have just created a system where a user needs to login with some type of username/password combo and you need to store the password (either in plaintext or in some type of database). How do you safely go about doing this? You could store it in plaintext, but this would be a bad idea. Anyone that has access to your server would also be able to get your passwords and the data that they are trying to protect.

A simple yet effective approach

In the past, sha1() or md5() would have been the most effective and secure way to encrypt your data, but recently it has been shown that these functions can be compromised and there is another set of more secure functions.

The function name is called hash(). Here is a list of it’s functionality/parameters:

string hash ( string algo, string data [, bool raw_output] )

Parameters
Algo: Name of selected hashing algorithm (i.e. “md5?, “sha256?, “haval160,4?, etc..)
Data: Message to be hashed.
Raw_Output: When set to TRUE, outputs raw binary data. Default value (FALSE) outputs lowercase hexits.
Returns: Returns a string containing the calculated message digest as lowercase hexits unless raw_output is set to true in which case the raw binary representation of the message digest is returned.

Using this function (note: this function is only available in php 5.1.2 and above)

common PHP security mistakes
You can use the following funcion: hash_algos() to get a list of system specific hashing algorithims that are supported by php.
(Inserting into your database/storing)

$password = hash(’sha256',$_POST[’password’);

  Print this    Email this