note 107144 deleted from function.sha1 by danbrown

Note Submitter: matt at zigg dot com ---- The previous SSHA example has very poor salt generation. rand() is not suitable for cryptographic use, only four bytes are used, and the sha1() call halves the effective bits that four bytes could otherwise represent. If you have the mcrypt extension, use this instead: $salt = mcrypt_create_iv(8, MCRYPT_DEV_URANDOM); $hash = "{SSHA}" . base64_encode(sha1($password . $salt, true) . $salt); If not, you could use fopen/fread to read eight bytes from the /dev/*random device of your choice and use that for the salt.