PHP Password Encryption Handling

Question

I have a password being passed from my iPhone app to the database via a php script, user.php.

The variable $pass is populated by the following:

$pass = str_replace("'", "", $_REQUEST['pass']);

How can I encrypt this before it's inserted into my database? I've read a little about the different techniques, but looking for the best way to manage this.

Thanks to everyone.

Answer 1

Most basic: Hash it with MD5 or SHA1

$newpass = md5($_REQUEST['pass']);

or

$newpass = sha1($_REQUEST['pass']);

Recently I started storing the username hashed as well, so login attempts are secure using only hashed data for comparisons.

You can "salt" the hashes with extra data so if they are compromised, it's value cannot be found (try googling some simple hashed words).. i.e. use a site-wide string just to alter the standard hash like md5("mySiteSalt!!" . $_REQUEST['pass']); or something more advanced.

Answer 2

Use php's crypt library. Md5 is not encryption, it is hashing.

Also, salt your passwords. Why?

• This answer
• Another good answer

Answer 3

Use crypt with some salt. Such as

$user = strip_tags(substr($_REQUEST['user'],0,32));
$plain_pw = strip_tags(substr($_REQUEST['pass'],0,32));

$password = crypt(md5($plain_pw),md5($user));

as on http://www.ibm.com/developerworks/opensource/library/os-php-encrypt/

Answer 4

If you don't care about retrieving the actual password's value (from the database encrypted value), you can run a one-way hash algorithm on it (such as sha1: http://php.net/manual/en/function.sha1.php). This function will return a specific length string (hash) which cannot be used to find the original string (theoretically). It is possible that two different strings could create the same hash (called a collision) but this shouldn't be a problem with passwords.
Example: $pass = sha1($_REQUEST['pass']);

One thing, to make it a little more secure is to add a salt to the hash and run the hash function again. This makes it more difficult to generate a password hash maliciously since the salt value is handled server-side only.
Example: $pass = sha1(sha1($_REQUEST['pass']).sha1("mySalt@$#(%"));

Answer 5

You should use SHA1 to hash your passwords for storage in the database. It's the simplest, yet most effective way to store passwords:

$password = sha1($password);

It's also exceptionally safe. Though the integrity of it is beginning to creep, it's rather easy to upgrade this function to SHA-256 (which is incredibly secure).

Answer 6

To find out why md5, sha1 and their speedy friends might not be a good idea, you should read the post Enough With The Rainbow Tables: What You Need To Know About Secure Password Schemes by Thomas Ptacek. The gist:

Finally, we learned that if we want to store passwords securely we have three reasonable options: PHK’s MD5 scheme, Provos-Maziere’s Bcrypt scheme, and SRP. We learned that the correct choice is Bcrypt.

Note: it's PHK, not php.

Answer 7

First, you should create a random user salt. Then you should store that and the password hash in the database.

$salt = md5(unique_id().mt_rand().microtime());
$pass = sha1($salt.$_REQUEST['pass']);

and save the $salt and $pass in the database. Then when they go to login you look up their row and check the hash:

$user = query('SELECT * FROM `user` WHERE username = ?', array($_REQUEST['username']));

if($user)
{
    // If the password they give maches
    if($user->pass === sha1($user->salt. $_REQUEST['pass']))
    {
        // login
    }
    else
    {
        // bad password
    }
}
else
{
    // user not found
}

Creating a user salt for each account insures rainbow tables are useless and anyone that broken into your server would have to brute-force each password.