Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

I've been working on a site that requires users to login. It's written in PHP with MySQL, and passwords are stored as Whirlpool hashes with a salt (source code later).

However, security sites or fellow developers have advised against this (actually, SHA-256, but the point remains) and have recommended bcrypt or PBKDF2. I'm not sure of the advantages of using one of these or why the current one is wrong. Does anybody mind explaining their reasoning?

Here's my code to register:

$escusrnm = $con->real_escape_string($_POST["usrnm"]);
$newSalt = substr(str_shuffle(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ),0, 1) . substr(str_shuffle(aBcEeFgHiJkLmNoPqRstUvWxYz0123456789),0, 31);
$passHashed = hash("whirlpool", $_POST["pss"].$newSalt);
$con->query("INSERT INTO users (username, pass, hash) VALUES ('{$escusrnm}', '{$passHashed}', '{$newSalt}')");
$_SESSION["usernm"] = $_POST["usrnm"];

Here's my login code:

$escusrnm = $con->real_escape_string($_POST["usrnm"]);
$getdats = $con->query("SELECT * FROM users WHERE username='{$escusrnm}'");
if (mysqli_num_rows($getdats) > 0) {
    $getdats = $getdats->fetch_assoc();
    if(hash("whirlpool", $_POST["pss"].($getdats["hash"])) == $getdats["pass"]) {
        $_SESSION["usernm"] = $getdats["username"];
    } else {
        $errormsg = "There was an error. Check your information again, or register.";
    }
} else {
    $errormsg = "There was an error. Check your information again, or register.";
}
share|improve this question

marked as duplicate by Terry Chia, TildalWave, Adnan, Xander, Scott Pack Jan 25 at 18:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

up vote 1 down vote accepted

I'm not sure of the advantages of using one of these or why the current one is wrong. Does anybody mind explaining their reasoning?

Bcrypt CAN BE stronger than whirlpool, it depends on your strength setting. This is one of the most important advantages about bcrypt, that you can increase the strength as computers get more powerful, plus it's extremely difficult to crack using a GPU compared to simple SHA/Whirlpool hashes.

Since PHP 5.5, we've had bcrypt available as easy to use functions. To create a hash you would use password_hash($pass), you don't need to worry about salts because one is automatically generated and placed inside of the hash, because of this you need to use password_verify($pass, $hash) to check a hash, as generating a hash will use a different salt every time (and your strength settings could change).

There is almost no reason not to use this for a new application, as it's proven to be much much more secure than standard hashing algorithms. If you're on a version of PHP older than 5.5 there are a variety of libraries available to assist with this, most commonly ircmaxell's password_compat.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.