What potential issues can arise from storing hashed values of usernames and passwords in a database?

One potential issue that can arise from storing hashed values of usernames and passwords in a database is the risk of a dictionary or brute force attack. To mitigate this risk, it is recommended to use a strong hashing algorithm, such as bcrypt, and to incorporate a unique salt for each user to prevent rainbow table attacks. 

// Generating a random salt for each user
$salt = bin2hex(random_bytes(16));

// Hashing the password with bcrypt and the unique salt
$hashed_password = password_hash($password . $salt, PASSWORD_BCRYPT);

// Storing the hashed password and salt in the database
$stmt = $pdo->prepare("INSERT INTO users (username, password, salt) VALUES (?, ?, ?)");
$stmt->execute([$username, $hashed_password, $salt]);

Keywords

SQL injection password hashing bcrypt password_verify password_hash

Related Questions