I've been using the
sha1() function to hash password before inserting it into my database. But I have this procedure so that it just won't be the password to be hashed.
My page would register a user along with their password. After submission, it would enter first the username into the database, then get the unique ID of that username. Then the system will combine it with the password.
$password = $userid.$password;
sha1() to hash the password:
$password = sha1($password);
Then update the password in the database with that ID.
I used the user id like a salt.
Is this a good technique? Though the only users of the system are the other department of our company, I think that it is enough for them in my opinion.
And what if I have a major project in the future that would required better security of password, will this be enough? Thanks!