Use sha256 as passwort hashing algorithm and use correct salt. The solution is backward compatible.
(the $PREFIX_account table needs a column 'salt CHAR(64))

Replaced random values generator with a potentially crytographic strong one.