emreakay/CodeIgniter-Aauth — pull request #7 by killfall (2014-06-05 19:58:04+00:00)
Title: Added stronger password encyption with salts

Made the password hashing function stronger.

You must now pass in the user_id into the hashing function too, this does cause a problem when creating the account as you have no user_id to pass in. So for now it passes in 0 as the user_id and then goes back and updates it once the entry has been added.

The function first creates a "salt" by running the user_id through md5 (we just want a long string that will be the same every time so md5 is fine). It then concatenates this "salt" with the password and encrypts that with the stronger sha256 hashing algorithm.

I used sha256 as there is much less chance of getting a collision and I added a salt based on the user_id so that even if two people select exactly the same password they will be stored as different hashes in the database.

Article on hashes
http://pbeblog.wordpress.com/2008/02/12/secure-hashes-in-php-using-salt/

Comment on why you shouldn't store password with just md5 or sha1
http://us2.php.net/manual/en/function.hash.php#94104

The only thing to bear in mind is the size of the field in the database, SHA256 is 64 chars where as MD5 is only 32 chars so it may cause a problem for people who have set an exact size. In the example sql file it is set to text so will be fine with that.