I was told that php mcrypt is deprecated, and I have to use a different method for hash and salt my passwords.
This is what I am doing now:
public function saveNewUser(array $data) {
$passwd = $this->mysqli->real_escape_string($datas['passwd']);
$options = [
'cost' => 11,
'salt' => mcrypt_create_iv(22, MCRYPT_DEV_URANDOM)
];
$hashed_passwd = password_hash($passwd, PASSWORD_BCRYPT, $options);
$this->optin_hash = md5(rand());
Login:
if (password_verify($_POST['user_password'], $result_row->gmw_usr_passwd)) {
1.) What is the last and most secure way to encrypt and save a password? Can you give an example of use or a link on how to correctly save the password for encryption and how to check it for login ?
2.) In php Documentary, I read something about password_hash:
password_hash () creates a new password hash using a strong one-way hash algorithm. password_hash () is compatible with crypt (). Therefore, the password hashes generated by crypt () can be used with password_hash ().
(...)
salt PHP 7.0.0. , .
2.a) password_hash , ?
2.b) ?
2.c) , , , ? ?
2.d) , password_hash?
EDIT: , , password_hash ( -).
Artjom B. mcrypt (?)