title: What is md5() for?
body: <p>I was reading this tutorial for a <a href="http://www.phpeasystep.com/workshopview.php?id=6" rel="nofollow noreferrer">simple PHP login system</a>.</p>
  
  <p>In the end it recommends that you should <a href="http://www.phpeasystep.com/workshopview.php?id=26" rel="nofollow noreferrer">encrypt your password using md5()</a>.</p>
  
  <p>Though I know this is a beginners' tutorial, and you shouldn't put bank statements behind this login system, this got me thinking about encryption.</p>
  
  <p>So I went ahead and went to (one of the most useful questions this site has for newbies): <a href="https://stackoverflow.com/questions/72394/what-should-a-developer-know-before-building-a-public-web-site">What should a developer know before building a public web site?</a></p>
  
  <p>There it says (under security) you should: </p>
  
  <blockquote>
    <p><strike>Encrypt</strike> Hash and salt passwords rather
    than storing them plain-text.</p>
  </blockquote>
  
  <p>It doesn't say much more about it, no references.</p>
  
  <p>So I went ahead and tried it myself:</p>
  
  <pre><code>$pass = "Trufa";
  $enc = md5($pass);
  
  echo $enc; #will echo 06cb51ce0a9893ec1d2dce07ba5ba710
  </code></pre>
  
  <p>And this is what got me thinking, that although I know md5() might not the strongest way to encrypt, anything that always produces the same result can be reverse engineered.</p>
  
  <p>So what is the sense of encrypting something with md5() or any other method?</p>
  
  <p>If a hacker gets to a password encrypted with md5(), <a href="http://md5.rednoize.com/" rel="nofollow noreferrer">he would just use this page!</a>.</p>
  
  <p>So now the actual questions:</p>
  
  <ol>
  <li><strong>How does password encryption work?</strong></li>
  </ol>
  
  <p>I know I have not discovered a huge web vulnerability here! :) I just want to understand the logic behind password encryption.</p>
  
  <p>I'm sure I'm understanding something wrong, and would appreciate if you could help me set my though and other's (I hope) straight.</p>
  
  <p><strong>How would you have to apply password encryption so that it is actually useful?</strong></p>
  
  <ol start="2">
  <li>What about this idea?</li>
  </ol>
  
  <p>As I said, I may/am getting the whole idea wrong, but, would this method add any security in security to a real environment?</p>
  
  <pre><code>$reenc = array(
   "h38an",
   "n28nu",
   "fw08d"
   );
  
  $pass = "Trufa";
  
  $enc = chunk_split(md5($pass),5,$reenc[mt_rand(0,count($reenc)-1)]);
  
  echo $enc;
  </code></pre>
  
  <p>As you see, I randomly added arbitrary strings (<code>$reenc = array()</code>) to my md5() password "making it unique". This of course is just a silly example.</p>
  
  <p>I may be wrong but unless you "seed the encryption yourself" it will always be easily reversible. </p>
  
  <p>The above would be my idea of "password protecting" and encrypted password, If a hacker gets to it he wont be able to decrypt it unless he gets access to the raw .php</p>
  
  <p>I know this might not even make sense, but I can't figure out why this is a bad idea!</p>
  
  <hr>
  
  <p>I hope I've made myself clear enough, but this is a very long question so, <strong>please ask for any clarification needed!</strong></p>
  
  <p>Thanks in advance!!</p>