note 80986 deleted from function.md5 by tularis
| From: | tularis@php.net | Date: | Thu, 14 Jul 2011 22:52:25 +0000 |
| Subject: | note 80986 deleted from function.md5 by tularis | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-181530@lists.php.net to get a copy of this message | ||
Note Submitter: heavyraptor
----
If you're afraid of rainbow tables (http://en.wikipedia.org/wiki/Rainbow_tables) listing your
md5/sha1 password you might simply hash your password twice or more than two times (with md5 or
sha1, or combining both). So save your password hashed more than once in your db to have full
security.
Examples:
<?php
$password = md5(md5($password));
$password = sha1(sha1($password));
$password = sha1(md5($password));
$password = md5(sha1($password));
?>
The following function might help to make it easier:
<?php
function hash_password($s,$t = 2) {
for ($i = 0; $i < $t; $i++)
$s = md5($s);
return $s;
}
/*
hash_password($password,2) = md5(md5($password))
hash_password($password,3) = md5(md5(md5($password)))
etc ...
*/
?>
Actually you might just use a different hash algorithm to hash your password, instead of using md5
or sha1. Most rainbow table list md5 and sha1 passwords, so you won't have problems with a
different hash function.