Question

I understand that I should md5(password.salt) before saving it to the database. But I have some curious questions:
+ Should I also md5 the content / text strings as well (with password as salt)?
Examples: if database is leaked, the attacker can’t read the contents of the closed forum
+ In case I shouldn’t md5 the content, and save them all as plain text, then what’s the point for attacker trying to get userpassword when he has database in hand?

Answer 1

The purpose of hashing passwords is to prevent a third party who gains access to your database from learning what the users’ passwords are. Your database contents are already compromised if they’ve gotten that far, so the forum contents are already exposed. What you don’t want is for people’s passwords to be compromised because many people use the same passwords across multiple web sites.

If you have a secure forum then you need to prevent attackers from accessing the database. If they get in, your forum posts are exposed. Don’t bother trying to protect them further. The idea is that if an attacker gains access to the database, you’ve limited the surface area of the damage. Your site data is compromised but hopefully not the users’ credentials. Some people will use their bank username and password on your web site, and that’s what you’re trying to protect.

Remember that hashing functions are one way. You can’t un-hash data. That’s fine for passwords: you don’t need to know what people’s passwords are, you just need to be able to compare them. It wouldn’t work for forum posts. Hashing isn’t encryption. Encrypted data can be decrypted. Hashed data cannot be un-hashed.