note 83043 added to function.sha1

If your still using sha1, here is a function that will hopefully help a little. Sorry for any grammatical mistakes and for naming convention, I'm not very original and in most cases get myself confused after some time with them too :( Benefits: even if attacker manages to generate string that will result in same hash, if that string doesn't have same amount of characters as original, it won't validate. <?php function obscure ($hString, $hDecode = NULL, $hSLength = 10, $keepLength = NULL, $minhPass = 10, $hMethod = sha1) { if ($hDecode == NULL) { $hSalt = array("\\", "!", "0", "\"", "1", "#", "2", "$", "3", "%", "4", "&", "5", "/", "6", "(", "7", ")", "8", "=", "9", "?", "*"); for ($i = 0; $i<16; $i++) { $hRandomIndex = array_rand($hSalt); $hRandomSalt .= $hSalt[$hRandomIndex]; } $hRandomSalt = hash($hMethod, $hRandomSalt); } else { $hRandomSalt = $hDecode; } if ($keepLength != NULL) { if ($hSLength > (strlen($hRandomSalt) - $minhPass)) { $hSLength = (strlen($hRandomSalt) - $minhPass); } } else if ($hSLength < 0) { $hSLength = 0; } $hLPosition = strlen($hString); while ($hLPosition > $hSLength) { $hNumber = substr($hLPosition, -1); $hLPosition = $hLPosition * ($hNumber/10); } $hLPosition = (integer)$hLPosition; $hRPosition = $hSLength - $hLPosition; $hFSalt = substr($hRandomSalt, 0, $hLPosition); $hLSalt = substr($hRandomSalt, -$hRPosition, $hRPosition); $hPassHash = hash($hMethod, ($hLSalt . $hString . $hFSalt)); if ($keepLength != NULL) { if ($hSLength != 0) { $hPassHash = substr($hPassHash, $hLPosition, -$hRPosition); } } return $hFSalt . $hPassHash . $hLSalt; } ?> How to use? $hString is string you want to hash, probably password. $hDecode is already hashed string (password). When you use function obscure() to generate hash, you will probably enter it in database. When user wants to log in, you pass plain password with $hString, and hashed password from database in $hDecode. $hSLength is length of salt. It's caped by method you use to hash, so in case you use sha1, you can pass value 100, but it will still use 40 characters. $keepLength can be used to cap final output at max characters that hash function gives. In case sha1, hash would give output of 40 characters. If you set $keepLength to '1' final outputted hash would have 40 characters by cutting pieces of hashed password. Why would you want to do it? So that attacker doesn't know it's salted :) $minhPass - it is usually defined only if you decide to set $keepLength so that you can define minimum amount of characters of hashed password you want to keep. Default is 10. It's used because you can accidentally set, in combination with $keepLength, $hSLength too high which would cause that all characters of hashed password are cut out and leave only salt which would always validate true without regard what password user enters. $hMethod defines which method you want to use to hash plain text since this function is build using hash(). If you want to use sha512, function will adapt to it. Quick example: Hashing a password - obscure ($plain_password); Validating password - obscure ($plain_password, $hashedPassword); I tried to be as brief as possible, best way to see how it's used... test it, otherwise mail me if you have questions. ---- Server IP: 69.147.83.197 Probable Submitter: 78.0.196.158 ---- Manual Page -- http://www.php.net/manual/en/function.sha1.php Edit -- https://master.php.net/note/edit/83043 Del: integrated -- https://master.php.net/note/delete/83043/integrated Del: useless -- https://master.php.net/note/delete/83043/useless Del: bad code -- https://master.php.net/note/delete/83043/bad+code Del: spam -- https://master.php.net/note/delete/83043/spam Del: non-english -- https://master.php.net/note/delete/83043/non-english Del: in docs -- https://master.php.net/note/delete/83043/in+docs Del: other reasons-- https://master.php.net/note/delete/83043 Reject -- https://master.php.net/note/reject/83043 Search -- https://master.php.net/manage/user-notes.php