这是否足够安全，用于散列

Question

hash('sha512', $_POST['password'] . time()) 

我听说过很多关于这个和那个的事情，并且无法得出结论......

Answer 1

我建议在创建和散列密码时添加一个盐 ，除此之外 - 是的。

Answer 2

You're using time() as a salt . You can do that, but don't forget to store it (otherwise, how would you ever be able to check that the given password concatenated with the salt matches the stored hash?). sha512 is a great choice for a hash algorithm. I'd suggest

$salt = uniqid('carlgcoder_') . microtime(true);
$hash = hash('sha512', $salt . $_POST['password']);

Answer 3

Use salt. Sample:

<?php
    $passwordWasSavedInDB = md5($_POST['password']."_paranoia_")