Question

I’ve the following code:

$salt=uniqid(mt_rand(), false);
#Add data to tables
mysql_query("INSERT INTO accounts VALUES('$user', '".hash('sha512',$pass+$salt)."', '$salt', '$cookie_value')");
mysql_query("INSERT INTO passwordreset VALUES('$user', NULL, NULL)");
#cookie creation
#.....
#cookie update
mysql_query("UPDATE accounts SET cookie='$cookie_value' WHERE user='$user'");

I sanitize data from form using these functions:

$var = htmlentities($var, ENT_QUOTES, "UTF-8");
return mysql_real_escape_string($var);

Today I logged into phpMyAdmin and I saw that passwords and salts for all users are the same.
Don’t remind me about deprecated mysql_* I know it, that’s just quick draft.

Answer 1

String concatenation in PHP uses . not +. Thus:

hash('sha512',$pass+$salt)

Should be

hash('sha512',$pass.$salt) // or
hash('sha512',"${pass}${salt}")