note 112102 added to faq.passwords

Why not salt an md5 or sha with a username or user id? Or rather at least include the username in the salt, it would mean no two users would have the same password hash and also the reverse dictionary lookups would be fruitless. E.g. $pwHash = md5($strPass.$saltConstant.$username) wouldnt that add the security required for most systems? ---- Server IP: 69.147.83.199 Probable Submitter: 80.194.38.179 ---- Manual Page -- http://php.net/manual/en/faq.passwords.php Edit -- https://master.php.net/note/edit/112102 Del: integrated -- https://master.php.net/note/delete/112102/integrated Del: useless -- https://master.php.net/note/delete/112102/useless Del: bad code -- https://master.php.net/note/delete/112102/bad+code Del: spam -- https://master.php.net/note/delete/112102/spam Del: non-english -- https://master.php.net/note/delete/112102/non-english Del: in docs -- https://master.php.net/note/delete/112102/in+docs Del: other reasons-- https://master.php.net/note/delete/112102 Reject -- https://master.php.net/note/reject/112102 Search -- https://master.php.net/manage/user-notes.php