note 54538 deleted from security.database.storage by joey

Note Submitter: blodo at poczta dot fm ---- You could always double hash the password, which might just be the easiest way to prevent a hash table crack which typically can only crack hashes that store about 8 characters in length (from what i know). For an additional amount of security you can always append a random salt, although you will need to store the salt to succesfully recover the password for checking. The code could look like this: <?php function createSalt ($charno = 5) { for ($i = 0; $i < $charno; $i++;) { $num = rand(48, 122); //This is roughly the ascii readable character range $salt .= chr($num); //Convert the number to a real character } return $salt; } $randomsalt = createSalt(); $hash = md5(md5($string_to_hash.$randomsalt)); /* Now append this to your database, but remember to store the salt somewhere too, or else you wont be able to check the password later on */ ?> Easy as pie. Hope this helps.