title: Which hashing algorithm to use for Password PHP
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/401656/secure-hash-and-salt-for-php-passwords">Secure hash and salt for PHP passwords</a>  </p>
  </blockquote>
  
  
  
  <p>For the encrypting of the password in the php file, I want to change to <strong><em>sha256</em></strong> or <strong><em>md5</em></strong> instead of using <strong><em>sha1</em></strong> as <em>iIwent</em> to research online and they say <strong><em>sha1</em></strong> is not so secure. </p>
  
  <p>How do I change in the <em>php</em> file?</p>
  
  <pre class="lang-php prettyprint-override"><code>&lt;?php
  
  class DB_Functions {
  
  private $db;
  
  //put your code here
  // constructor
  function __construct() {
      require_once 'DB_Connect.php';
      // connecting to database
      $this-&gt;db = new DB_Connect();
      $this-&gt;db-&gt;connect();
  }
  
  // destructor
  function __destruct() {
  
  }
  
  /**
   * Storing new user
   * returns user details
   */
  public function storeUser($name, $nric, $email, $license, $address, $postal_code, $password) {
      $hash = $this-&gt;hashSSHA($password);
      $encrypted_password = $hash["encrypted"]; // encrypted password
      $salt = $hash["salt"]; // salt
      $result = mysql_query("INSERT INTO users(name, nric, email, license, address, postal_code, encrypted_password, salt, created_at) VALUES('$name', '$nric', '$email', '$license', '$address', '$postal_code', '$encrypted_password', '$salt', NOW())");
      // check for successful store
      if ($result) {
          // get user details 
          $uid = mysql_insert_id(); // last inserted id
          $result = mysql_query("SELECT * FROM users WHERE uid = $uid");
          // return user details
          return mysql_fetch_array($result);
      } else {
          return false;
      }
  }
  
  /**
   * Get user by nric and password
   */
  public function getUserByNricAndPassword($nric, $password) {
      $result = mysql_query("SELECT * FROM users WHERE nric = '$nric'") or die(mysql_error());
      // check for result 
      $no_of_rows = mysql_num_rows($result);
      if ($no_of_rows &gt; 0) {
          $result = mysql_fetch_array($result);
          $salt = $result['salt'];
          $encrypted_password = $result['encrypted_password'];
          $hash = $this-&gt;checkhashSSHA($salt, $password);
          // check for password equality
          if ($encrypted_password == $hash) {
              // user authentication details are correct
              return $result;
          }
      } else {
          // user not found
          return false;
      }
  }
  
  /**
   * Check user is existed or not
   */
  public function isUserExisted($nric) {
      $result = mysql_query("SELECT nric from users WHERE nric = '$nric'");
      $no_of_rows = mysql_num_rows($result);
      if ($no_of_rows &gt; 0) {
          // user existed 
          return true;
      } else {
          // user not existed
          return false;
      }
  }
  
  /**
   * Encrypting password
   * @param password
   * returns salt and encrypted password
   */
  public function hashSSHA($password) {
  
      $salt = sha1(rand()); //algorithm hash
      $salt = substr($salt, 0, 10);
      $encrypted = base64_encode(sha1($password . $salt, true) . $salt);
      $hash = array("salt" =&gt; $salt, "encrypted" =&gt; $encrypted);
      return $hash;
  }
  
  /**
   * Decrypting password
   * @param salt, password
   * returns hash string
   */
  public function checkhashSSHA($salt, $password) {
  
      $hash = base64_encode(sha1($password . $salt, true) . $salt);
  
      return $hash;
  }
  
  }
  
  ?&gt; 
  </code></pre>