I am using sha1 function to store my password in mysql DB..
$passwordHash = sha1($password);
From google I got this From user registration
sha1( sha1(users_plaintext_password)+random string )
To check
server computes sha1( users_hashed_password_in_database +
$_SESSION['random_string'] )
if $_POST['password'] ==
sha1( users_hashed_password_in_database + $_SESSION['random_string'] )
My question is how do I check for validation?Is this the correct method?? And does using some random string as salt give my password more protection??
I would do it as follows:
Then do the same with data entered by the user:
The seed is a good idea, because users often pick passwords that are easy to guess. Another advantage is that you may be able to restore security to your site by changing the seed if someone manages to hack their way in.