note 81387 added to function.md5

I think the suggestion to double-hash your password is not a good idea. You are much much better off adding a variable salt to passwords before hashing (such as the username or other field that is dissimilar for every account). Double hashing is *worse* security than a regular hash. What you're actually doing is taking some input $passwd, converting it to a string of exactly 32 characters containing only the characters [0-9][A-F], and then hashing *that*. You have just *greatly* increased the odds of a hash collision (ie. the odds that I can guess a phrase that will hash to the same value as your password). sha1(md5($pass)) makes even less sense, since you're feeding in 128-bits of information to generate a 256-bit hash, so 50% of the resulting data is redundant. You have not increased security at all. The wikipedia article linked in the last post advocates using a salt. No where (that I see) does it advocate using the double hash approach. ---- Server IP: 64.71.164.2 Probable Submitter: 207.162.210.145 ---- Manual Page -- http://www.php.net/manual/en/function.md5.php Edit -- https://master.php.net/note/edit/81387 Del: integrated -- https://master.php.net/note/delete/81387/integrated Del: useless -- https://master.php.net/note/delete/81387/useless Del: bad code -- https://master.php.net/note/delete/81387/bad+code Del: spam -- https://master.php.net/note/delete/81387/spam Del: non-english -- https://master.php.net/note/delete/81387/non-english Del: in docs -- https://master.php.net/note/delete/81387/in+docs Del: other reasons-- https://master.php.net/note/delete/81387 Reject -- https://master.php.net/note/reject/81387 Search -- https://master.php.net/manage/user-notes.php