Secure password storage

Question

I'm developing a web service where users must login. I will store user data in an SQL database and input/output via PHP. But I don't want to store it openly. How do I encrypt the passwords in PHP so only those who knows the password can unlock it?

I know services like phpBB uses some sort of hiding/encryption on stored passwords.

Answer 1

You need to salt and hash the password, using an appropriately secure algorithm.

• PHP's mhash has appropriate hashing functions
• A full example here on SO