note 79580 deleted from function.mysql-real-escape-string by danbrown
| From: | danbrown@php.net | Date: | Sat, 14 Mar 2009 15:04:48 +0000 |
| Subject: | note 79580 deleted from function.mysql-real-escape-string by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-151919@lists.php.net to get a copy of this message | ||
Note Submitter: Vijay
----
<?php
$try_pass=md5($_POST['u_pass']);
?>
I would also suggest to add a salt to the MD5 function. So that hackers are able to retreive all the
data because of some application bug, they can't be able to get the pain text passwords using a
code as follows:
<?php
define('SALT_LENGTH', 9);
function generateHash($plainText, $salt = null)
{
if ($salt === null)
{
$salt = substr(md5(uniqid(rand(), true)), 0, SALT_LENGTH);
}
else
{
$salt = substr($salt, 0, SALT_LENGTH);
}
return $salt . sha1($salt . $plainText);
}
?>
Code from: http://phpsec.org/articles/2005/password-hashing.html