Secure hashing and salt for passwords in PHP
Hello everyone! I'm a beginner PHP developer and trying to understand secure storage of user passwords. Currently I'm using MD5 with salt, but I've been told it's not secure. My current code looks like this:\n\n```php\nfunction createPassword($password) {\n $salt = 'my_very_secret_salt_12345';\n return md5($salt . $password);\n}\n\nfunction checkPassword($password, $hash) {\n $salt = 'my_very_secret_salt_12345';\n return md5($salt . $password) === $hash;\n}\n```\n\nI understand that MD5 is outdated, but I don't know what to replace it with. I've heard about bcrypt, password_hash and password_verify, but I don't understand how to use them correctly.\n\nMain questions:\n1. How to properly generate a salt for each password?\n2. Do I need to store the salt separately and how to pass it during verification?\n3. Which algo
No answers yet.
Log in to leave an answer