Steven Brown

Whatever web language you are programming in (PHP, ASP, etc.) you will no doubt come across the need to implement an authentication or user login system at some point.

There is an obvious need to protect passwords in some way, otherwise discovering the password field, through SQL injection or other attack, would allow an attacker to login as another user.

So the password MD5 was born. On the surface this is relatively sound, hash the password using the MD5 algorithm. The original password can never be directly retrieved from the hash so even if someone does get access to view the password field, they do not actually know the password and cannot use it directly to login.
(continue reading…)