SHA1

[Xtremer360]

Is this okay to do for dealing with passwords before running an insert query into a database?

 

$password = sha1(mysqli_real_escape_string($dbc, $_POST['password']));

[shlumph]

Sure. Note that SHA1 won't generate quotations, so you *could* do:

$password = sha1($_POST['password']);

if you wanted.

[requinix]

In fact, you shouldn't mysqli_real_escape_string the password if you're going to hash it right afterwards. You're corrupting the data.

 

You should, on the other hand, "corrupt" the password intentionally by using a salt. It's an added security measure but requires that you track the salt (or figure a good way to compute it, creating the same salt everytime for the same person but a different salt for a different person) and the password.

[Xtremer360]

Thank you both.