What are the potential security risks of storing login hashes in a database for a PHP login system?

Storing login hashes in a database for a PHP login system can pose a security risk if the hashes are not properly secured. If an attacker gains access to the database, they could potentially use rainbow table attacks or brute force methods to crack the hashes and gain access to user accounts. To mitigate this risk, it is recommended to use a strong hashing algorithm like bcrypt with a unique salt for each user to securely store passwords. 

// Hashing password using bcrypt with a unique salt
$password = 'password123';
$salt = uniqid(mt_rand(), true); // Generate a unique salt
$hashed_password = password_hash($password . $salt, PASSWORD_BCRYPT);

// Storing hashed password and salt in the database
// INSERT INTO users (username, password, salt) VALUES ('example', $hashed_password, $salt);

Keywords

SQL injection password hashing bcrypt salting session hijacking

Related Questions