flurdy/flurdy.com-docs — pull request #1 by thoughtmonster (2013-10-02 08:10:54+00:00)
Title: Have encrypt() encrypt the passwords using the SHA-256 scheme

The default DES scheme used by crypt() only considers the first 8 characters of a password, as I discovered to my surprise. Prefixing the salt value with the string '$5$' makes crypt() use the SHA-256 scheme, which apart from having no character limit, is more secure in the event of a data leak.

I append a random MD5 string to the prefix, otherwise encrypt() would produce identical hashes for the same passwords. It's a bit more complex, but it works.