note 70631 deleted from function.md5 by tularis
| From: | tularis@php.net | Date: | Sun, 22 Oct 2006 15:56:01 +0000 |
| Subject: | note 70631 deleted from function.md5 by tularis | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-118977@lists.php.net to get a copy of this message | ||
Note Submitter: heavyraptor
Reason: useless
----
If you're not sure if md5 or sha1 is secure enough because of password list, try this function:
<?php
function secure_hash($input) {
$chrs = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
$chrslen = strlen($chrs);
$hash = md5($input) . sha1($input) . dechex(abs(crc32($input)));
$hash = str_split($hash,5);
foreach ($hash as $k => $hexval) {
$str = "";
$int = hexdec($hexval);
while ($int > 0) {
$str = $chrs[$int % $chrslen] . $str;
$int = floor($int / $chrslen);
}
$hash[$k] = $str;
}
return implode("",$hash);
}
?>
It'll convert your input into a more secure hash-value (using md5 + sha1 + crc32). The output
gets compressed with 62 chars (0-9a-zA-Z) instead of 16 like md5 or sha1 (0-9a-f).
Database crackers (with help of mysql injections for example) won't be able to encode the
password, because there are no password list for such encoded strings. You'll have tripple
security with this function.
Note: PHP-version >= 5 is required, because of the used function str_split().
Example:
<?php
echo secure_hash('my password');
// output: RU3cZM1zpW3Drw1GAr14H5OL52sUar0Q2d462Rs418aC2svy1mQbVHW2ZnE
?>
Have fun