title: Switching from md5() to crypt()
body: <p>So far I have been using md5 to hash passwords on my site, no salt.</p>
  
  <p>Now I am building an application that will have to be more secure and I'm reading md5 can be easily brute-force attacked.</p>
  
  <p>So I want to use <a href="http://www.php.net/manual/en/function.crypt.php" rel="nofollow"><code>crypt()</code></a> to hash the passwords.</p>
  
  <p>What I have not fully understood is:</p>
  
  <ol>
  <li>Do I have to provide a salt or is the built-in generated one ok?</li>
  <li>How many times (if more than one) should I iterate the crypt function to be safe?</li>
  <li>With md5, no matter the length of the input string, the hash was 32-digit. Does crypt return a standard length of hashes too?</li>
  </ol>