note 109592 deleted from function.crypt by danbrown
| From: | danbrown@php.net | Date: | Fri, 10 Aug 2012 16:24:37 +0000 |
| Subject: | note 109592 deleted from function.crypt by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-190027@lists.php.net to get a copy of this message | ||
Note Submitter: sarciszewski at knights dot ucf dot edu
----
This is my preferred method of random salt generation (above the mt_rand() example below):
<?
// convBase from http://www.php.net/manual/es/function.base-convert.php#106546
$cost = 10 + (date("Y") - 2010);
$salt = '$2a$'.$cost.'$';
$salt .= substr(convBase( raw2hex( openssl_random_pseudo_bytes(16) ),
'0123456789abcdef',
'0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ./'), 0, 22);
$salt .= '$';
$hash = crypt($_POST['password'], $salt);
?>
Cost increases 1 per year, and the salt comes from reliable pseudorandom data.