note 88885 added to function.hash

When using hash() for storing passwords, I've found that the best practice is not to use just one salt, but two. This example uses my preferred algorithm for passwords, whirlpool. <?php function doubleSalt($toHash,$username){ $password = str_split($toHash,strlen($toHash)/2); $hash = hash('whirlpool', $username.$password[0].'centerSalt'.$password[1]); return $hash; } echo doubleSalt('my4w3s0m3p4sw+rd','kevin'); ?> This way, even if someone can produce a rainbow table for your algorithm, and has the salt to do it with, they will never know where in the hash parameter the second salt was placed, because they don't know the length of the actual password. ---- Server IP: 64.71.164.2 Probable Submitter: 24.255.221.112 ---- Manual Page -- http://www.php.net/manual/en/function.hash.php Edit -- https://master.php.net/note/edit/88885 Del: integrated -- https://master.php.net/note/delete/88885/integrated Del: useless -- https://master.php.net/note/delete/88885/useless Del: bad code -- https://master.php.net/note/delete/88885/bad+code Del: spam -- https://master.php.net/note/delete/88885/spam Del: non-english -- https://master.php.net/note/delete/88885/non-english Del: in docs -- https://master.php.net/note/delete/88885/in+docs Del: other reasons-- https://master.php.net/note/delete/88885 Reject -- https://master.php.net/note/reject/88885 Search -- https://master.php.net/manage/user-notes.php