can someone help me. I’ve been reading about salting a password to make my passwords more secure. The format I was going with is salt:password_hashed, so my code is md5($salt.":".$password_hashed). $password_hashed is a simple m5d string of the original password, and the hash is taken from mktime().
I don’t understand how the salt works, do i need to save this in the database as well? If the salt is ever changing, how does this work?
If a user registered with the password ‘password’ and the time they registered was 1234567890 (as a unix timestamp). The password generate would be md5(mktime().":".$_POST['password']) or something lik that. But if a user trys to then login with ‘password’ the newly created salt would be different?
You have to store the salt too, you could for example just store the registrationdate and use that in your salt.