Double Hashing Using MD5 with SHA-1

Question

The following code creates an MD5 hash and then hashes it again with SHA-1 – is this secure?

$user = $_POST['username'];
$username = mysqli_real_escape_string($mysqli, $user);
$pass = md5($_POST['password']);
$password = sha1($pass);

Does this increase collision possibilities?
Are there any other ways in order to hash and be very fast in processing the password?

Answer 1

There is no practical advantage over single hashing.

Note that MD5 is now considered broken as it is vulnerable to many practical attacks, and algorithms such as SHA1 are not recommended for password hashing.

There are algorithms designed specifically for password hashing, such as PBKDF2. You should use PBKDF2 as your hash - see this question on security.stackexchange.com. .

Answer 2

Use sha2 https://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html#function_sha2

mysql> SELECT SHA2('abc', 224);

SHA2() can be considered cryptographically more secure than MD5() or SHA1().

SHA2() was added in MySQL 5.5.5.