How to save the random salt to the database

Question

As I understand it, salting and hashing passwords is the way to go. I also understand that to authenticate a salted and hashed password, the random salt needs to be saved. Does this mean that if I use the following code to process the password:

$blowfish_salt = bin2hex(openssl_random_pseudo_bytes(22));  
$hash = crypt($data, "$2a$12$".$blowfish_salt);  

then I would need to create a column in my users table that has to hold the value of $blowfish_salt?

Am I correct in thinking that

1. The above code needs to be included in the php that processes the registration form?
2. The processing form has to send the value in $blowfish_salt to the table to be stored next to the password?
3. The salt is stored as is - no need for it to be processed/obscured?
4. At the time of authentication, how the salt was generated in the first place need not be known?
5. If by some coincidence two users select the same password, the stored salted and hashed value will make that immaterial?
   How will the authentication code use the salt? Is there a specific code for this?

I also found the following code in a tutorial as a method of preventing sql injection:

//this function is to guard against sql injection

function prevent($this) {  
 $this = stripslashes($this);  
 $this = mysql_real_escape_string($this);  
 return $this;    
}

//the prevent() can be used like this on form fields to prevent sql injection  
prevent($username);  
prevent($password);  

Do I need to use this if I am salting and hashing the password in the registration form? Wouldn't any malicious code get scrambled in the process? Or am I missing something?

Answer 1

You're salt is saved in the hash generated by your crypt() function. To verify the password all you need to do is:

$res = crypt($password, $hash);

$res will return 1 if the password is correct.

1. You need to save the password hashed, so yes.
2. Nope this is already contained in the string you generated (if you look closely you can see that the hash is actually delimited in several sections)
3. Salts are never considered secret so that's not a problem
4. Refer to 2.
5. They will be different because the salts will be different

Your SQL injection prevention is not considered secure, more details about that can be found here SQL injection that gets around mysql_real_escape_string() on Stackoverflow and yes you should always sanitize variables before processing them. There are tons of resources available on this website about how to prevent SQL injection correctly. In general you shouldn't be using mysql_ functions in PHP. PHP has some nice tools which handle all these problems for you like MySQLi and PDO. Also have a look at stored procedures.