1

I'm trying to hash passwords for our company site. After testing on a local Apache server that has PHP 5.5.9 and everything working as expected, I went to test on our live server being hosted by GoDaddy. The problem is that when I run my code there, it doesn't work. A phpinfo() statement revealed that the version is PHP 5.3.24.

This presents a bit of a problem because the modern hash functions that I see for PHP, like password_hash(), were written in PHP 5.5 or newer. I don't really see many resources for password encryption for anything older than 5.3.7 and I think it's probably wisest to update.

Are there PHP password hashing functions for 5.3.24 or should I ask my boss to consider updating the server? Aside from accessing the local Apache server, the GoDaddy server is out of my hands except for FTP access, so I have no clue if this is something we can update or not.

  • 7
    PHP 5.5 is the oldest version still receiving security patches. Definitely upgrade. – Alexander O'Mara Jun 7 '16 at 17:29
  • 1
    Check with GoDaddy tech support, they may have multiple versions running on the server for backwards compatibility available to users that refuse to upgrade their WordPress Compromise servers and changing to a newer version either will be set through the control panel or via an .htaccess setting. – Fiasco Labs Jun 7 '16 at 18:40
  • 1
    Take security seriously and bite the bullet? Also the suggestion by @FiascoLabs may be true. – Alexander O'Mara Jun 7 '16 at 18:41
  • 1
    What @AlexanderO'Mara says. Unpatched servers have no place on today's internet. End of story. – Little Code Jun 7 '16 at 18:47
  • 1
    I'm gonna ask the "stupid" question here: Why is your test environment not running the same software (and versions) that are in production? Unless you're already working on updating the server, and the test is to verify functionality of the new software, the two systems should be the same in this regard. That said, +1 to all saying upgrade is needed. EoL software is bad. – Iszi Jun 7 '16 at 20:21
6

Upgrading to the latest supported stable PHP branch is the recommended route plain and simple.

That being said, you've noted that you're with GoDaddy. Which of their services are you using for the project? If it's their shared hosting line, or any line that offers cPanel, upgrading PHP versions shouldn't add anything to current costs. Any web hosting provider with common sense should be able to easily run EasyApache, cPanel's built-in utility for updating and upgrading Apache, PHP and various other pieces of software.

If you're on a VPS, Cloud Server or Dedicated Server, the above still applies if you're using cPanel. If you're running barebones and someone is managing everything from the CLI (nice!), upgrading is a bit more time consuming, though not by much. They'll need to make sure the correct packages are installed before compiling, or, they could simply use built-in packages offered by upstream.

Even if you rely on certain packages, chances are upstream repositories can cater to your needs. If not, there's always building on to an existing package.


That said, if your boss is dead-set on sticking with dated releases, when it comes to PHP 5.3.7+, I'll reference ircmaxwell and paragonie, both of which are available on GitHub.

password_compat - link

The purpose of this library is to "...provide forward compatibility with the password_ functions that ship with PHP 5.5."

random_compat - link

The purpose of this library is to provide PHP 5.x support for random_bytes() and random_int() (from PHP 7.x). This isn't an alternative to password_compat, it's simply another compatibility layer that will allow you to bring features that you're not going to be able to use (unless you're able to upgrade, of course) down.


Note: If you're going to use random_compat, make sure you're using a stable release instead of the master (as noted by the author).

github.com/paragonie/random_compat/releases/tag/v2.0.2

0

login your godaddy account navigate to My Products >> C panel hosting then under softwares click on "select PHP version" and then select php 5.5 or higher...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.