How can I encrypt my website registration and login password? -Php Tutorial

How can I encrypt my website registration and login password? I have read many articles in this regard on the Internet, all of which refer to the client password. when logging on, I will use md5 encryption to send it to the server, and then compare the server with the salt in the database and the encrypted password.

I don't understand. if this is the case

Assume that the user name of User A is abcd and the password is 123456. after md5 is encrypted, it is e10adc3949ba59abbe56e057f20f883e.
The hacker accidentally obtained the username abcd and password e10adc3949ba59abbe56e057f20f883e.

At this time, he does not need to know that the abcd password is 123456, and does not need to understand how e10adc3949ba59abbe56e057f20f883e is generated. he only needs to enter the user name: abcd, and then the password: e10adc3949ba59abbe56e057f20f883e to call the service and you can log on.

How can we avoid this situation?

Reply to discussion (solution)

How do hackers know the username abcd and ciphertext?

Client does not require encryption
You only need to follow the normal user name and password to log on.

Then, the server performs the md5 (md5 (password) + salt) operation on the password to generate the encrypted password. Salt is obtained from the database.
Compare with the encrypted password in the database.
If they are the same, the logon is successful. Otherwise, the logon fails.

The advantage of this approach is that even if the database is hacked, the user's plaintext password cannot be known.

The server password is so different.

If ($ row ['pwd'] = md5 ($ _ POST ['pwd']) {
//
}
Even if someone else knows the password after MD5, but comes to the server, it needs to be encrypted again, or encrypted multiple times and then compared.

Even if hackers hacked into your database, they obtained your member's username and encrypted password, because md5 encryption is basically irreversible, therefore, hackers cannot call the services you know to perform login operations.

However, one layer of md5 encryption is not very secure, and many websites provide md5 decryption. We recommend that you encrypt the md5 data multiple times or add your custom string and then encrypt it in md5 (md5 (user_passwd.your_defined_string )).