What are the best practices for securely storing passwords in a MySQL database using PHP, considering the limitations of hash algorithms like MD5 and SHA1?

When storing passwords in a MySQL database using PHP, it is crucial to securely hash the passwords to protect them from potential breaches. While MD5 and SHA1 are commonly used hash algorithms, they are no longer considered secure due to their vulnerability to brute force attacks. Instead, it is recommended to use stronger algorithms like bcrypt or Argon2 for password hashing in PHP. 

// Generate a secure salt
$salt = random_bytes(16);

// Hash the password using bcrypt
$hashed_password = password_hash($password, PASSWORD_BCRYPT, ['salt' => $salt]);

// Store the hashed password and salt in the database
$stmt = $pdo->prepare("INSERT INTO users (username, password, salt) VALUES (?, ?, ?)");
$stmt->execute([$username, $hashed_password, $salt]);

Keywords

PHP MySQL password hashing security bcrypt

Related Questions