PHP salt and hash SHA256 for login password

Question

I've made encrypting of the password in my register script and they are stored in the database, and I have to use them to login, so I would want to use the unencrypted ones to login. I've read some of the threads in here but nothing is helping me. How can I add it in my login.php? The salt is also stored in the database.

This is my register.php script for encrypting

$hash = hash('sha256', $password1);  function createSalt() {     $text = md5(uniqid(rand(), TRUE));     return substr($text, 0, 3); }  $salt = createSalt(); $password = hash('sha256', $salt . $hash); 

and this is my login.php with season

//Create query $qry="SELECT * FROM member WHERE username='$username' AND password='$password'"; $result=mysql_query($qry);  //Check whether the query was successful or not if($result) {     if(mysql_num_rows($result) > 0) {         //Login Successful         session_regenerate_id();         $member = mysql_fetch_assoc($result);         $_SESSION['SESS_MEMBER_ID'] = $member['id'];         $_SESSION['SESS_FIRST_NAME'] = $member['username'];         $_SESSION['SESS_LAST_NAME'] = $member['password'];         session_write_close();         header("location: profile.php");         exit();     }     else {         //Login failed         //error message      } else {     die("Query failed"); } 

Answer 1

These examples are from php.net. Thanks to you, I also just learned about the new php hashing functions.

Read the php documentation to find out about the possibilities and best practices: http://www.php.net/manual/en/function.password-hash.php

Save a password hash:

$options = [     'cost' => 11, ]; // Get the password from post $passwordFromPost = $_POST['password'];  $hash = password_hash($passwordFromPost, PASSWORD_BCRYPT, $options);  // Now insert it (with login or whatever) into your database, use mysqli or pdo! 

Get the password hash:

// Get the password from the database and compare it to a variable (for example post) $passwordFromPost = $_POST['password']; $hashedPasswordFromDB = ...;  if (password_verify($passwordFromPost, $hashedPasswordFromDB)) {     echo 'Password is valid!'; } else {     echo 'Invalid password.'; } 

Answer 2

According to php.net the Salt option has been deprecated as of PHP 7.0.0, so you should use the salt that is generated by default and is far more simpler

Example for store the password:

$hashPassword = password_hash("password", PASSWORD_BCRYPT);

Example to verify the password:

$passwordCorrect = password_verify("password", $hashPassword);