How to store passwords safely with PHP and MySQL
First, let me tell you how not to store passwords and why.
Do not store password as plain text
This should be obvious. If someone gains access to your database then all user accounts are compromised. And not only that, people tend to use the same password on different sites so those accounts will be compromised as well. Your site doesn’t even need to be hacked; a system administrator could easily browse your database.
Do not try to invent your own password security
Chances are that you’re no security expert. You’re better off using a solution that has been proven to work instead of coming up with something yourself.
Do not encrypt passwords
Encryption may seem like a good idea but the process is reversible. Anyone with access to your code would have no trouble transforming the passwords back to their originals. Security through obscurity is not sufficient!
I'm ElbertF, a Dutch web developer living in Australia. I built websites for a living and work on experimental projects for fun.
