如何安全地存储密码等注册/登录信息？

Question

I am in the process of resecuring my registration on my website and want to ask if my password hashing is correct. Or if there is any better more secure way I can do it. I read somewhere that the salt can be written to the database on a per user basis.

This is my security so far:

$salt = sha1(md5($activecode).$username);

$username = mysql_real_escape_string($_POST['username']);
$activecode = mysql_real_escape_string(time());
$pass1 = sha1(md5($_POST['pass1'].$salt));
$pass2 = sha1(md5($_POST['pass2'].$salt));

Answer 1

This very code snippet has very little with security. As well as with common sense. What's the use of doing hashes of both passwords? I guess you have to compare entered passwords and then make a hash of just one.

MD5 is really wrong here. Just make it sha1($_POST['pass1'].$salt));

mysql_real_escape tring is a database related function, not form handling one. A right place to use it is right before adding data into query. For the strings going into query enclosed in quotes.

And what Joe have said.