Simple PHP Auth Class feedback this is a basic PHP auth class I've put together for use with simple sites I do from time to time which don't warrant using a framework. I'm wondering if i'm separating out responsibilities all that well, even at this early stage! For example, I'm not sure where I should be filtering user input with mysql_real_escape_string, and I don't know if I should be passing the DB into the constructor, but then I need it to be able to run my auth check. 

Anyway, any pointers would be great thanks!

class Auth {

    protected $db;

    /**
     * Auth::__construct()
     * 
     * @return
     */
    public function __construct($db = null)
    {
        $this-&gt;db = $db;
    }

    /**
     * Auth::login()
     * 
     * @param mixed $username
     * @param mixed $password
     * @return
     */
    public function login($username, $password)
    {
        $query = $this-&gt;db-&gt;query("SELECT username, password 
                                    FROM users 
                                    WHERE username = '".mysql_real_escape_string($username)."'
                                    AND password = '".self::crypt_pass(mysql_real_escape_string($password))."'
                                  ");

        $result = $this-&gt;db-&gt;fetch_array($query);

        if (count($result) == 0)
        {
            return FALSE;
        }
        else
        {
            //set session variable 
            Session::instance()-&gt;set('logged_in', TRUE);
            return TRUE;
        }
    }

    /**
     * Auth::logout()
     * 
     * @return
     */
    public function logout()
    {
        //set session variable 
        return Session::instance()-&gt;delete('logged_in');
    }

    private function crypt_pass($pass)
    {
        if (CRYPT_BLOWFISH == 1)
        {
            $salt = SHA1('acssalty457');
            $blowfish_salt = "\$2a\$07\$".substr($salt, 0, CRYPT_SALT_LENGTH);
            return crypt($pass, $blowfish_salt);
        }
    }
}
This part doesn't make sense to me:

private function crypt_pass($pass)
{
    if (CRYPT_BLOWFISH == 1)
    {
        $salt = SHA1('acssalty457');
        $blowfish_salt = "\$2a\$07\$".substr($salt, 0, CRYPT_SALT_LENGTH);
        return crypt($pass, $blowfish_salt);
    }
}


Functions that only return on condition are a bad idea. You should return something anyway, even if it's false. Now for the specific problem, what if CRYPT_BLOWFISH != 1? It's ok to want to use blowfist, but why cripple the library for everyone else? You could rewrite as:

private function crypt_pass($pass) {
    $salt = "acssalty457";

    if (CRYPT_BLOWFISH == 1) {
        $blowfish_salt = "\$2a\$07\$" . substr($salt, 0, CRYPT_SALT_LENGTH);
        return crypt($pass, $blowfish_salt);
    }

    return sha1($pass . $salt);        
}


Notice that I don't hash the salt? That's because security wise that's useless. You can ask around at Cryptography Stack Exchange for more. If you want to make the sha1 crypted pass a little bit harder you could do something weird like: 

return sha1(strrev($salt) . $pass . $salt);


I'm using sha1 as an example of a natively included function, you can use any hash algorithm you like.