PHP has a variety of algorithms which enable hiding actual passwords and get the maximum security by using encryption techniques. The most common password encryption methods among PHP developers are as follows.
PASSWORD HASHING
Hashing methodology is considered as one of the safest techniques for securing passwords.
Hashing algorithm is applied to password fields before data insertion in database. In this way, you make the password unexploitable in case of hacker attack. It is important to note at this point that hashing passwords protects within data store, but it doesn’t guarantee protection against interception by any malicious code.
Most common hashing functions are
md5 ():
It displays the md5 hash of a string.
SALT
Cryptographic salt data is basically a bit of data which makes it more difficult to crack the data. If you are using salt, then it is impossible to exploit your password. Salt is a string which is hashed with password so that dictionary attacks would not work.
How to store salts?
Crypt () and password_hash () are used to store salts.
Crypt ():
It is basically one way hashing. Crypt () is used to get a hashed string. Its general syntax contains a salt parameter which is optional, but without salt, a weak password is generated. This function uses MD5, Blowfish and DES algorithms. This function’s performance varies with respect to operating systems.
PASSWORD_HASH ()
It creates new passwords by means of one way hashing algorithm. It is compatible with crypt(). Password_hash () is one of the strongest techniques of creating secure passwords.
Password_verify()
It is used to verify If the entered password matches the encryption.
Example
<?php
$hash = ‘$2y$07$BCryptRequires22Chrcte/VlQH0piJtjXl.0t1XkA8pw9dMXTpOq’;
If (password_verify(‘rasmuslerdorf’, $hash))
{
echo ‘Password is valid!’;
}
else
{
echo ‘Invalid password.’;
}
?>
Output
Password is valid!
We have covered the most commonly used hashing functions. These functions will help you to make your passwords more safe and secure.
u