在mysql数据库中保护用户密码的最佳方法？ [关闭]

Question

I'm trying to find the best way to secure user passwords in a mysql database (hashing/encryption wise). I was which method was the most secure and hardest to crack. I am not very experience in the realm of encryption/hashing etc. Currently I am using a very unsecure method of doing this sort of encryption:

$encrypted_password = strrev(base64_encode($password));

I know that isn't the best way to do it, but like I said, I'm new. Could anyone point my in the right direction?

Thanks.

Answer 1

Edit: You should take a look at hash_hmac(). I think it's a better approach than just salting.

You can use sha1 and a salt:

$salt = "some random string";
$encrypted_password = sha1($salt.$password);

You add the salt to make it harder to use rainbow tables in case somebody manages to get the encrypted password list.

You could use any one-way hashing method (I just like sha1), but it's always better to salt it before hashing.