As I understand it, salting and hashing passwords is the way to go. I also understand that to authenticate a salted and hashed password, the random salt needs to be saved. Does this mean that if I use the following code to process the password:

$blowfish_salt = bin2hex(openssl_random_pseudo_bytes(22));  
$hash = crypt($data, "$2a$12$".$blowfish_salt);  

then I would need to create a column in my users table that has to hold the value of $blowfish_salt?

Am I correct in thinking that

  1. The above code needs to be included in the php that processes the registration form?
  2. The processing form has to send the value in $blowfish_salt to the table to be stored next to the password?
  3. The salt is stored as is - no need for it to be processed/obscured?
  4. At the time of authentication, how the salt was generated in the first place need not be known?
  5. If by some coincidence two users select the same password, the stored salted and hashed value will make that immaterial?
    How will the authentication code use the salt? Is there a specific code for this?

I also found the following code in a tutorial as a method of preventing sql injection:

//this function is to guard against sql injection

function prevent($this) {  
 $this = stripslashes($this);  
 $this = mysql_real_escape_string($this);  
 return $this;    

//the prevent() can be used like this on form fields to prevent sql injection  

Do I need to use this if I am salting and hashing the password in the registration form? Wouldn't any malicious code get scrambled in the process? Or am I missing something?


You're salt is saved in the hash generated by your crypt() function. To verify the password all you need to do is:

$res = crypt($password, $hash);

$res will return 1 if the password is correct.

  1. You need to save the password hashed, so yes.
  2. Nope this is already contained in the string you generated (if you look closely you can see that the hash is actually delimited in several sections)
  3. Salts are never considered secret so that's not a problem
  4. Refer to 2.
  5. They will be different because the salts will be different

Your SQL injection prevention is not considered secure, more details about that can be found here SQL injection that gets around mysql_real_escape_string() on Stackoverflow and yes you should always sanitize variables before processing them. There are tons of resources available on this website about how to prevent SQL injection correctly. In general you shouldn't be using mysql_ functions in PHP. PHP has some nice tools which handle all these problems for you like MySQLi and PDO. Also have a look at stored procedures.

  • Thanks Lucas! I have read several posts here and on SO that said that the salts needed to be saved. So now I am MORE confused! – vinaya Jul 24 '13 at 11:32
  • IIRC the salt is saved within the string generated by the crypt function in PHP. – Lucas Kauffman Jul 24 '13 at 11:35
  • Thanks Lucas! I have read several posts here and on SO that said that the salts needed to be saved. So now I am MORE confused! (Isn't it possible to place a line break in a comment?) I am literally learning PHP, Mysqli, and the rest as I go - sort of in an Object-Oriented style (get it?!) - sort of learning what I need for my project. Could you answer the last question too? (Wouldn't any malicious code get scrambled in the process? Or am I missing something?) That one is just so that I learn some more! – vinaya Jul 24 '13 at 11:41
  • I answered that, you need to sanitize all your input variables before running them. Also were those people using PHPs crypt function? – Lucas Kauffman Jul 24 '13 at 11:45
  • Sorry for the repeat post - my laptop was hanging for a few minutes and I didn't realize I had already submitted the comment! – vinaya Jul 24 '13 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.