Practical Guide to Secure Password Storage in PHP and MySQL: From MD5 to Modern Hashing Techniques

The Importance of Password Storage Security

In web application development, secure storage of user passwords forms the foundation of system security. Traditionally, many developers used the MD5 algorithm for password hashing, but this approach has serious security flaws. The MD5 algorithm is not only computationally fast and vulnerable to brute-force attacks but also lacks a salt mechanism, making rainbow table attacks possible.

Modern Password Hashing Techniques

Modern password storage should employ stronger hashing algorithms such as SHA-256 or SHA-512. More importantly, unique salt values must be generated for each password. A salt is a piece of random data combined with the original password before hashing, ensuring that even if two users have the same password, their hash values will differ.

Implementation of User Registration Process

The following code demonstrates the secure handling of passwords during user registration:

<?php
// Receive and sanitize user input
$escapedName = mysql_real_escape_string($_POST['name']);
$escapedPW = mysql_real_escape_string($_POST['password']);

// Generate a 32-byte random salt
$salt = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));

// Combine password with salt
$saltedPW = $escapedPW . $salt;

// Hash using SHA-256
$hashedPW = hash('sha256', $saltedPW);

// Store data in database
$query = "INSERT INTO user (name, password, salt) VALUES ('$escapedName', '$hashedPW', '$salt');";
?>

In this implementation, we first use the mysql_real_escape_string() function to prevent SQL injection attacks. Then we generate a strong random salt, combine it with the password, and perform SHA-256 hashing. Finally, we store the username, hashed password, and salt together in the database.

User Login Verification Process

When a user attempts to login, the system needs to verify whether the provided password matches the stored hash:

<?php
// Receive login credentials
$escapedName = mysql_real_escape_string($_POST['name']);
$escapedPW = mysql_real_escape_string($_POST['password']);

// Retrieve the user's salt from database
$saltQuery = "SELECT salt FROM user WHERE name = '$escapedName';";
$result = mysql_query($saltQuery);

// Error handling (must be implemented in production)
if (!$result) {
    die('Query failed: ' . mysql_error());
}

$row = mysql_fetch_assoc($result);
$salt = $row['salt'];

// Process input password with same salt and algorithm
$saltedPW = $escapedPW . $salt;
$hashedPW = hash('sha256', $saltedPW);

// Verify password
$query = "SELECT * FROM user WHERE name = '$escapedName' AND password = '$hashedPW';";
$loginResult = mysql_query($query);

if (mysql_num_rows($loginResult) > 0) {
    // Login successful
    echo "Login successful!";
} else {
    // Login failed
    echo "Invalid username or password.";
}
?>

The key to the verification process is using exactly the same algorithm and salt as during registration. The system first retrieves the user's salt from the database, then combines the user-input password with this salt, performs the same hash calculation, and finally compares the result with the hash stored in the database.

Security Considerations and Best Practices

1. Avoid MD5: The MD5 algorithm has been proven insecure and should no longer be used for password storage. Even with salting, MD5's fast computation makes it vulnerable to brute-force attacks.

2. Use Strong Random Salts: Salts must be sufficiently long (at least 16 bytes) and completely random. Each user should have a unique salt to prevent attackers from using precomputed rainbow tables.

3. Prevent SQL Injection: Always properly escape user input or use parameterized queries. The mysql_real_escape_string() used in the examples provides basic protection, but modern PHP development should use PDO or MySQLi prepared statements.

4. Consider Specialized Functions: PHP provides password_hash() and password_verify() functions that internally use the bcrypt algorithm and automatically handle salt generation, offering a more secure and convenient option.

5. Error Handling: Production code must include comprehensive error handling to avoid leaking sensitive information to users.

Comparison with Traditional Methods

Comparing with the traditional MD5 approach shown in Answer 2:

// Insecure method
$query = "INSERT INTO users (username, password) VALUES('bob','" . md5('bob123') . "');";

This method has multiple issues: using the weak MD5 hashing algorithm, lacking a salt mechanism, and producing identical hash values for identical passwords. Attackers can easily crack such passwords using rainbow tables.

Conclusion

Secure password storage is a critical aspect of web application development. By using strong hashing algorithms (like SHA-256), generating unique salts for each password, and implementing proper input validation, system security can be significantly enhanced. Although the examples in this article use specific PHP functions, the core principles apply to any programming language and database system. Developers should stay informed about the latest advances in cryptography and regularly update their security practices.