I'm currently implementing a login system. I want to store the password and the salt in a database. Now I found out that there is a hash()
and a crypt()
function which seems to do the same (valid for SHA512).
hash()
is newer and seems to support more hashing alogrithms than crypt()
. Or there any other differences I should know/care about?
Edit:
function generatePasswordHash($password){
$salt = base64_encode(mcrypt_create_iv(8));
$calculatedPasswordHash = crypt($password, '$1$' . $salt . '$');
return $calculatedPasswordHash;
}
The result looks like $1$Qh6ByGJ9$zLn3yq62egvmc9D7SzA2u.
Here my password checking function:
function checkLoginData($username, $password){
global $db;
$sql = "SELECT * FROM users WHERE username = :username";
$result = $db->ExecuteQuery($sql, array("username"=>$username));
if(!empty($result)){
$result = $result[0];
$savedPasswordHash = $result['password'];
$splitted = explode("$", $savedPasswordHash);
$salt = $splitted[2];
$calculatedPasswordHash = crypt($password, '$1$' . $salt . '$');
if($savedPasswordHash === $calculatedPasswordHash){
return true;
}
}
return false;
}
See Question&Answers more detail:
os 与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…