note 88885 deleted from function.hash by danbrown

Note Submitter: kevin at bionichippo dot com ---- When using hash() for storing passwords, I've found that the best practice is not to use just one salt, but two. This example uses my preferred algorithm for passwords, whirlpool. <?php function doubleSalt($toHash,$username){ $password = str_split($toHash,strlen($toHash)/2); $hash = hash('whirlpool', $username.$password[0].'centerSalt'.$password[1]); return $hash; } echo doubleSalt('my4w3s0m3p4sw+rd','kevin'); ?> This way, even if someone can produce a rainbow table for your algorithm, and has the salt to do it with, they will never know where in the hash parameter the second salt was placed, because they don't know the length of the actual password.