Question

I would like to build my own login system to be as secure as possible.
Encrypting passwords with MD5 and stripping extra data with

$password = strip_tags($password);
$password = mysql_real_escape_string($password);
$password = md5($password);

I’ve seen tokens in some examples but dont really understand the usefulness.
edit – I was corrected and it is salts and not tokens I have seen.

Answer 1

Its not called a token, its called a salt.

If we don’t salt the password, you could have duplicate password hashes.

If I and someone else has the same password (lets say StackOverflow)

• Me – StackOverflow – 84d7dc19766c446f5e4084e8fce87f82
• Someone else – StackOverflow – 84d7dc19766c446f5e4084e8fce87f82

But with a salt,

• Me – StackOverflowMeSalt – 9a0126445be2d0b0bc6ab9728aae1323
• Someone else – StackOverflowSomeone elseSalt – 66f6bd8d92f084dabd7e2dd588b2bfcb

Also, theres no need to use mysql_real_escape_string or strip_tags on a password when its hashed. This will make the passwords more insecure.