Best way to store passwords in MYSQL database [duplicate]

by

First off, md5 and sha1 have been proven to be vulnerable to collision attacks and can be rainbow tabled easily (when they see if you hash is the same in their database of common passwords).

There are currently two things that are secure enough for passwords that you can use.

The first is sha512. sha512 is a sub-version of SHA2. SHA2 has not yet been proven to be vulnerable to collision attacks and sha512 will generate a 512-bit hash. Here is an example of
how to use sha512: 

<?php
hash('sha512',$password);

The other option is called bcrypt. bcrypt is famous for its secure hashes. It’s probably the most secure one out there and most customizable one too.

Before you want to start using bcrypt you need to check if your sever has it enabled, Enter
this code: 

<?php
if (defined("CRYPT_BLOWFISH") && CRYPT_BLOWFISH) {
    echo "CRYPT_BLOWFISH is enabled!";
}else {
echo "CRYPT_BLOWFISH is not available";
}

If it returns that it is enabled then the next step is easy, All you need to do to bcrypt a password is (note: for more customizability you need to see this How do you use bcrypt for hashing passwords in PHP?): 

crypt($password, $salt);

A salt is usually a random string that you add at the end of all your passwords when you hash them. Using a salt means if someone gets your database, they can not check the hashes for common passwords. Checking the database is called using a rainbow table. You should always use a salt when hashing!

Here are my proofs for the SHA1 and MD5 collision attack vulnerabilities:
http://www.schneier.com/blog/archives/2012/10/when_will_we_se.html, http://eprint.iacr.org/2010/413.pdf,
http://people.csail.mit.edu/yiqun/SHA1AttackProceedingVersion.pdf,
http://conf.isi.qut.edu.au/auscert/proceedings/2006/gauravaram06collision.pdf and
Understanding sha-1 collision weakness

More Related Contents:

  1. PHP DateTime supported formats
  2. Can I call a PHP function in a JavaScript click handler?
  3. You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘WHERE `id` [closed]
  4. PHP parse/syntax errors; and how to solve them
  5. How to extract and access data from JSON with PHP?
  6. PHP validation/regex for URL
  7. continue processing php after sending http response
  8. MySQL – This version of MySQL doesn’t yet support ‘LIMIT & IN/ALL/ANY/SOME subquery
  9. how to detect search engine bots with php?
  10. Parse XML with Namespace using SimpleXML [duplicate]
  11. How to write into a file in PHP?
  12. PHP: Merge 2 Multidimensional Arrays
  13. “[notice] child pid XXXX exit signal Segmentation fault (11)” in apache error.log [closed]
  14. How to change maximum number of POST variable in PHP?
  15. Restructure multidimensional array of column data into multidimensional array of row data [duplicate]
  16. PHP max_input_vars
  17. Shorthand for arrays: is there a literal syntax like {} or []?
  18. What does this mean in documentation: square bracket followed by comma ( [, ) [duplicate]
  19. PHP Get Highest Value from Array
  20. PHP compare array
  21. Sending multiple attachment in an email using PHP
  22. REST API Authorization & Authentication (web + mobile)
  23. PHP include causes white space at the top of the page
  24. how to iterate over non-English file names in PHP
  25. Get orders shipping items details in WooCommerce 3
  26. Laravel Cannot delete or update a parent row: a foreign key constraint fails
  27. How can I do a migration in laravel 5.5?
  28. looping a SQL insert statement with dates
  29. How can I list data in sections by an ID, with a while loop in PHP? [closed]
  30. find in set in laravel ? example

Leave a Comment