Creating a Secure Hash in PHP

When creating a web application with users it is always important to securely hash their password. We are going to go over how to create a hash that is impossible to brute force.

We’ll assume that this script is open to the public and anyone can see the algorithm we use – so how do we make it uncrackable and non-bruteforcable?

The answer is randomly generated salts. We’ll randomly generate a salt, store it in a database along with the username, hashed password and any other user associated information, and then generate their hashed password based off of the salt and password.

When we check to see if they have a valid username/password we will check the database for the username the user supplied (via cookies or when logging in), pull out the password salt, hash the password that they have given with the salt and see if it fits the hash in the database.

The Code

First we’ll need to create a database (we’ll be using MySQL) and create a table within it. We’ll call the database “app” and the table “users”. For our intents and purposes we will only have three fields: the user ID, the username, and the hashed password. The user ID field will be auto incrementing. To create the table we will execute the following SQL:

CREATE TABLE `app`.`users` (
`uid` INT NOT NULL AUTO_INCREMENT ,
`username` TEXT NOT NULL ,
`hash` TEXT NOT NULL ,
`salt` TEXT NOT NULL ,
PRIMARY KEY ( `uid` )
)

Now we’re going to create a function which will register the user, first hashing the inputted password. We’re going to use the uniqid() function to generate the salt. To create the hash based off the salt we’ll use crypt(). Here’s the code:

function register($user, $password)
{
    $salt = uniqid(mt_rand()); // Create a salt based off the time, prefixed with a random number.
    $hash = crypt($password, $salt); // Generate the hash.
}

Next in the function we insert the data into our table.

// We'll escape the input before this

$con = mysql_connect("localhost","peter","abc123"); // Fill in database server, username and password
if (!$con)
{
  die('Could not connect: ' . mysql_error());
}

mysql_select_db('app', $con);

mysql_query("INSERT INTO users (username, hash, salt)
VALUES ('$user', '$hash', '$salt')");

mysql_close($con);

All together now:

function register($user, $password)
{
    $salt = uniqid(mt_rand()); // Create a salt based off the time, prefixed with a random number.
    $hash = crypt($password, $salt); // Generate the hash.
    // Prepare the data for the database
    $salt = mysql_real_escape_string($salt);
    $hash = mysql_real_escape_string($hash);
    $user2 = mysql_real_escape_string($user);
    $con = mysql_connect("localhost","peter","abc123");
    if (!$con)
    {
       die('Could not connect: ' . mysql_error());
    }
    mysql_select_db('app', $con);
    mysql_query("INSERT INTO users (username, hash, salt)
    VALUES ('$user2', '$hash', '$salt')");
    mysql_close($con);
}

Now we need a function which checks to see if the user supplied info (which would normally be stored in cookies or used during login) is valid. We’ll need to know their inputted username and password.

First we’ll connect to the database and find the salt and password hash given the username. To do this we’ll use the following SQL:

SELECT hash, salt
FROM users
WHERE username = '$username'

function validateUser($username, $password)
{
    $user = mysql_real_escape_string($username);
    $con = mysql_connect("localhost","peter","abc123");
    if (!$con)
    {
       die('Could not connect: ' . mysql_error());
    }
    mysql_select_db('app', $con);
    $info = mysql_query("SELECT hash, salt FROM users WHERE username = '$user");
    $row = mysql_fetch_row($info);
    mysql_close($con);
}

Now that we’ve selected the proper row, the hash is stored in $row[0] and the salt is stored in $row[1]. For clarity’s sake we’ll assign them to $hash and $salt.

$hash = $row[0];
$salt = $row[1];

Next we’ll hash the password using $salt and check to see if it matches $hash.

$hashCheck = crypt($password, $salt);
if ($hashCheck == $hash)
{
    // The user provided a valid username and password.
}

And the final function:

function validateUser($username, $password)
{
    $user = mysql_real_escape_string($username);
    $con = mysql_connect("localhost","peter","abc123");
    if (!$con)
    {
       die('Could not connect: ' . mysql_error());
    }
    mysql_select_db('app', $con);
    $info = mysql_query("SELECT hash, salt FROM users WHERE username = '$user'");
    $row = mysql_fetch_row($info);
    mysql_close($con);
    $hash = $row[0];
    $salt = $row[1];
    $hashCheck = crypt($password, $salt);
    if ($hashCheck == $hash)
    {
        // The user provided a valid username and password.
    }
}

There you have it! A secure way to create and verify password hashes in PHP, perfect for any user system. I hope you enjoyed this article and feel free to leave a comment!