title: Crypt() salt generation and password encryption, well executed?
body: <p>these are some functions I am using for password encryption and password verification. Was wondering if this is a good way to handle it. I am using the codeigniter framework.</p>
  
  <p>This is the function to 'encrypt' :</p>
  
  <pre><code>function crypt_pass( $input ){
      $salt = substr(sha1(date('r')), rand(0, 17), 22);
      $cost = 10;
      $hash = '$2y$' . $cost . '$' . $salt;
  
      $pw_and_salt['pw'] = crypt($input, "$hash");
      $pw_and_salt['salt'] = $salt;
  
      return $pw_and_salt;
  }
  </code></pre>
  
  <p>I store both the password and the salt in my DB. Here is the login function:</p>
  
  <pre><code>function login(){
  
      $this-&gt;db-&gt;select('salt');
      $salt = $this-&gt;db-&gt;get_where('users', array('username' =&gt; $this-&gt;input-&gt;post('username') ) )-&gt;row();
  
  
  
      $where = array(
          'username' =&gt; $this-&gt;input-&gt;post('username'),
          'password' =&gt; crypt( $this-&gt;input-&gt;post('password'), '$2y$10$' . $salt-&gt;salt),
      );
  
  
      $user = $this-&gt;db-&gt;get_where('users', $where)-&gt;first_row();
  
      if (!$user) {
          return FALSE;
      }else{
          if(!empty($user-&gt;activation)){
  
              return 2;
  
          }else if($user &amp;&amp; empty($user-&gt;activation)){
              $this-&gt;session-&gt;set_userdata('id',$user-&gt;id);
              $this-&gt;session-&gt;set_userdata('username',$user-&gt;username);
              $this-&gt;session-&gt;set_userdata('first_name',$user-&gt;first_name);   
  
              return 1;
          }
      }
  }
  </code></pre>
  
  <p>Am I implementing this the right way? Is this enough security?</p>
  
  <p>VERSION 2 : NOT STORING SALT, EXTRACTING FROM PASSWORD IN DB INSTEAD :</p>
  
  <pre><code>function login(){
  
      $this-&gt;db-&gt;select('password');
  
      $pw = $this-&gt;db-&gt;get_where('users', array('username' =&gt; $this-&gt;input-&gt;post('username') ) )-&gt;row();
  
  
      $where = array(
          'username' =&gt; $this-&gt;input-&gt;post('username'),
          'password' =&gt; crypt( $this-&gt;input-&gt;post('password'), $pw-&gt;password),
      );
  
      $user = $this-&gt;db-&gt;get_where('users', $where)-&gt;first_row();
  
      if (!$user) {
  
          return FALSE;
  
      }else{
  
          if(!empty($user-&gt;activation)){
  
              return 2;
  
          }else if($user &amp;&amp; empty($user-&gt;activation)){
  
              $this-&gt;session-&gt;set_userdata('id',$user-&gt;id);
              $this-&gt;session-&gt;set_userdata('username',$user-&gt;username);
              $this-&gt;session-&gt;set_userdata('first_name',$user-&gt;first_name);   
  
              return 1;
          }
      }
  }
  </code></pre>