3

What is the best way to hash passwords in PHP 5.3.5? Since in this version doesn't have password_hash().

7
  • 4
    Best idea is to update - that version of PHP has been out of support for a while (unless it's part of a long term support linux distro), so any security flaws in it will not be fixed. It's even too old for the compatibility library mentioned in the PHP manual on password_hash!
    – Matthew
    Feb 24, 2016 at 7:33
  • But the problem is that I have a site in a hosting server that only support that version. Thanks anyway. Feb 24, 2016 at 7:39
  • 1
    Yeah, it's not an uncommon problem. Might be worth speaking with them to see if they can update the PHP version - would be bad if you are doing things properly and then get breached due to a flaw in outdated server software.
    – Matthew
    Feb 24, 2016 at 8:41
  • Agreed; complain to them, and realize there are likely a lot of vulnerabilities that were patched in later versions. Or find a new hosting provider that keeps up with patches! Feb 24, 2016 at 17:57
  • There is a compatibility pack available for PHP versions 5.3.7 and later, made by one of the guys behind PHP, Anthony Ferrara. You can find it here. Mar 2, 2016 at 19:16

1 Answer 1

4

If you can update the version of PHP it's best to do so, but sometimes shared hostings have older versions of PHP like yours which do not support password_hash().

Phpass seems to suit well in this case.

phpass (pronounced "pH pass") is a portable public domain password hashing framework for use in PHP applications. It is meant to work with PHP 3 and above, and it has actually been tested with at least PHP 3.0.18 through 5.4.x so far. (PHP 3 support is likely to be dropped in next revision.)

The preferred (most secure) hashing method supported by phpass is the OpenBSD-style Blowfish-based bcrypt, also supported with our public domain crypt_blowfish package (for C applications), and known in PHP as CRYPT_BLOWFISH, with a fallback to BSDI-style extended DES-based hashes, known in PHP as CRYPT_EXT_DES, and a last resort fallback to MD5-based salted and variable iteration count password hashes implemented in phpass itself (also referred to as portable hashes).


Note: if you happen to have PHP version >= 5.3.7 you can also use password_compat

3
  • is this essentially bcrypt? I know is possible to use bcrypt package without upgrading
    – TheHidden
    Feb 24, 2016 at 11:13
  • Don't forget to increase the work factor if you can! Feb 24, 2016 at 17:56
  • @silverpenguin Yes, I believe that is correct.
    – Muhammet
    Feb 24, 2016 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .