Question

I’m wanting to store hashed passwords in MySQL, I’m using PHP:

<?php
    $salt = '!£$%^&*()#';
    $username = 'abc';
    $password = '123';
    $hash = hash('sha1', $username . $salt . $password, true);
?>

The true parameter in hash() will return the value as raw binary data. But I don’t understand what this means exactly. How should it be correctly stored in MySQL?

Answer 1

I found the solution.

Normal (hexed) hashes of sha1() are always CHAR(40) in length. When you return a hash as raw binary data in php, it will return a string as CHAR(20), saving 50% database space yet representing the exact same value. This is because 2 characters of hex can be compressed into 1 character, thus halving it the space needed.

So store the password as CHAR(20) and use the *_bin collation.