Password encryption in codeginiter function Password encryption in codeginiter function codeigniter codeigniter

Password encryption in codeginiter function


To do specifically what you need, the following code will work:

$password = md5($this->security->xss_clean($this->input->post('password')));

However, as has been stated in the comments, md5 is a very bad choice for storing passwords, and it should be avoided at all costs. You should also avoid sha1 and anything else which is quick to hash with. For more information, check out Jeff Atwood's blog post, your password is too damn short. Specifically the following part :

And for developers:

Pick your new password hash algorithms carefully, and move all your old password hashing systems to much harder to calculate hashes. You need hashes that are specifically designed to be hard to calculate on GPUs, like scrypt.

Even if you pick the "right" hash, you may be vulnerable if your work factor isn't high enough. Matsano recommends the following:

scrypt: N=2^14, r=8, p=1

bcrypt: cost=11

PBKDF2 with SHA256: iterations=86,000

But those are just guidelines; you have to scale the hashing work to what's available and reasonable on your servers or devices. For example, we had a minor denial of service bug in Discourse where we allowed people to enter up to 20,000 character passwords in the login form, and calculating the hash on that took, uh … several seconds.

The post also covers just how quickly attempts to crack the passwords can be made for any given hash algorithm (in tries per second)

  • NTLM = 350,000,000,000
  • MD5 = 180,000,000,000
  • SHA1 = 63,000,000,000
  • SHA512Crypt = 364,000
  • bCrypt = 71,000

Obviously the lower the amount of tries per second which can be performed, the more time it takes to break the hashing.

With that in mind, please re-consider your hashing choice for your application and make it use sensible hashing for passwords