Password Encryption Method? : PASSWORD() versus md5?

Question

Just wondering if there are pros and cons to methods of password encryption... Typically, I'll use php and encrypt a password using md5 before inserting a new user into the database. I inherited a project recently and they use PASSWORD() in the sql insertion query to encrypt it. So, now I'm wondering if there's advantages to using one over the other?

Answer 1

See the MySQL docs for PASSWORD:

The PASSWORD() function is used by the authentication system in MySQL Server; you should not use it in your own applications. For that purpose, consider MD5() or SHA2() instead. Also see RFC 2195, section 2 (Challenge-Response Authentication Mechanism (CRAM)), for more information about handling passwords and authentication securely in your applications.

Below that note is one very good reason not to rely on that function:

Statements that invoke PASSWORD() may be recorded in server logs or in a history file such as ~/.mysql_history, which means that plaintext passwords may be read by anyone having read access to that information.

Passwords are generally best stored with salted hashes (SHA, etc.). Here's an answer which lists a few useful links about safe password storage.