note 18466 deleted from function.crypt by aidan

Note Submitter: anonymous ---- Note that md5crypt and md5 are NOT the same. md5crypt is salted to prevent "birthday attacks", and goes through many iterations to make it expensive to attack. (Don't be alarmed, it's only expensive if you're brute-forcing or dictionary attacking it, human-typed passwords won't cause load on your web server). The salting is a *must*, otherwise 2 people picking the same password will have the same hash (saving an attacker a lot of time!). IMHO, crypt() should use the DES-based crypt, and md5crypt() and bfcrypt() should be in separate functions. (the PHP 4.0.4 -> 4.1.1 upgrade broke some of the sites on my webserver due to this sillyness!)