Question

Which method is more secure and what are its disadvantages?

// Using a salt.
$keyed_hash = hash_hmac("sha512", $string.$salt);

// Using a key.
$keyed_hash = hash_hmac("sha512", $string, $key);

Answer 1

What are you trying to do? They have different purposes, in general, but if you are planning to use them to store passwords, they are approximately equivalent. The net result will be similar if the salt is random (as it must be) and the key is random. If you use the same key for everything (or the same salt) then the security level drops dramatically. You have to store the key or salt separately, but it doesn’t matter if someone sees it (as long as you’re using, say, 64-bit random numbers).
The HMAC computation is more computing intensive than the simple SHA512 computation. If your purpose is to make attackers work harder, then it is better. But the simpler SHA512 with a 64-bit salt will be adequate for most purposes.

Be aware that at the end of 2012, there will be a new SHA3 algorithm selected; NIST is in the later stages of a competition to choose a new algorithm to replace the SHA2 algorithms, of which SHA512 is one specimen.