mysql salt bcrypt_php – Crypt()salt生成和密码加密,执行得很好？

这些是我用于密码加密和密码验证的一些功能.想知道这是否是处理它的好方法.我正在使用codeigniter框架.

这是’加密’的功能：

function crypt_pass( $input ){

$salt = substr(sha1(date('r')), rand(0, 17), 22);

$cost = 10;

$hash = '$2y$' . $cost . '$' . $salt;

$pw_and_salt['pw'] = crypt($input, "$hash");

$pw_and_salt['salt'] = $salt;

return $pw_and_salt;

}

我将密码和盐存储在我的数据库中.这是登录功能：

function login(){

$this->db->select('salt');

$salt = $this->db->get_where('users', array('username' => $this->input->post('username') ) )->row();

$where = array(

'username' => $this->input->post('username'),

'password' => crypt( $this->input->post('password'), '$2y$10$' . $salt->salt),

);

$user = $this->db->get_where('users', $where)->first_row();

if (!$user) {

return FALSE;

}else{

if(!empty($user->activation)){

return 2;

}else if($user && empty($user->activation)){

$this->session->set_userdata('id',$user->id);

$this->session->set_userdata('username',$user->username);

$this->session->set_userdata('first_name',$user->first_name);

return 1;

}

}

}

我是以正确的方式实施的吗？这足够安全吗？

版本2：不存储盐,在DB INSTEAD中从密码中提取：

function login(){

$this->db->select('password');

$pw = $this->db->get_where('users', array('username' => $this->input->post('username') ) )->row();

$where = array(

'username' => $this->input->post('username'),

'password' => crypt( $this->input->post('password'), $pw->password),

);

$user = $this->db->get_where('users', $where)->first_row();

if (!$user) {

return FALSE;

}else{

if(!empty($user->activation)){

return 2;

}else if($user && empty($user->activation)){

$this->session->set_userdata('id',$user->id);

$this->session->set_userdata('username',$user->username);

$this->session->set_userdata('first_name',$user->first_name);

return 1;

}

}

}