How to use BCrypt - PHP Snippets - Tutorial #1

People often wonder how to safely store passwords, BCrypt is the answer. So how do you use BCrypt for PHP?

Watch this PHP Snippet and find out!

Also check out these link for more information about BCrypt:

[VirtousOn]

Thank you so much for making a tutorial on this! been looking for one for a while now! I subscribed to your channel.

[IlluminaticHD]

How exactly would I include this within a query?

[DsNLFireworks]

Could you please make a tutorial about the random salt? :)

[mattm]

I know this is about hacking passwords, but wouldn't using PDO with prepared statements be a better practice to get into to prevent SQL Injection? Check stack exchange for the vulnerabilities of real escape string

[TeachMeUp]

Yeah, you don't need to download anything at all. You can just use the function in the video and it'll work :)

[VirtousOn]

I can't find the salt creation tutorial

[TrekOfTheTrade]

So I can use bcript without downloading cript_blowfish-1.x?

[nirayoshikage]

Thank! that help me a lot form security but... how to decrypt?? ._.

[justin]

Aaaaah!!! There's a huge vulnerability with the prevent function which would definitely result in an SQL Injection attack! His way ran the function but didn't return to the variables.

Do this instead:

function prevent(&$str) // note the & operator
{
$str =
}
prevent($username);
prevent($password);

The & operator gives the function access to the variable entered. This doesn't require a return because you are changing the variable data directly.

[justin]

Also as mentioned in the video you need to randomly generate a salt. The point of the salt is to make every password unique. If a hacker got into the db they'd have access to this salt so it's still possible to crack passwords, but as long as the salts are unique, even if users have the same password the hashes will be different thus making the task that much more a pain in the ass for Mr. Hacker. Be safe kids!

[kikocarisse]

I'm thinking the salt tutorial wasn't made because then everyone would know how to hack all of his sites. Posting his salting methods to the public would make all of his work less secure.