title: Password hash in PHP: Am I Doing This Right?
body: <p>I'm trying to create a login system using PHP, and I'm not quite sure if my script is really good, check out bellow.</p>
  
  <p>So, I created two functions... One of them to create the hash and another one to check it out.</p>
  
  <p>Check out the functions:</p>
  
  <pre><code>function createSaltedPass($pass = false, $username = false) {
    if($pass &amp;&amp; $username)
    {
      $salt = hash('sha256', uniqid( mt_rand(), true ) . md5(date('d m Y H i s') . " # ") . $username);
  
      $pass = hash('sha256', $salt . $pass . $salt);
  
      $pass = $salt . $pass;
  
      return $pass;
    }
  }
  </code></pre>
  
  <p>The snippet above creates a huge hash (to be specific 128 characters), and I don't know if it's really secure. </p>
  
  <p>The first half is the salt, and it makes me able to check it out when it's needed.</p>
  
  <p>The second half is the real salted password.</p>
  
  <p>See an example of the password:</p>
  
  <p>939cf87873a402d48bcf66a57b64ca38d6f1db9155381ffe1aae9a469e93d1e7ec338071f2dd21a96ef5fc799a3f3921b0df3188458b17422db79271056a1fda</p>
  
  <p>Look at the function to check the password after using the first function:</p>
  
  <pre><code>function checkSaltedPass($dbPass = false, $pass = false) {
    if($pass &amp;&amp; $dbPass)
    {
      $salt = substr($dbPass, 0, 64);
  
      $pass = hash('sha256', $salt . $pass . $salt);
  
      $pass = $salt . $pass;
  
      return $pass;
    }
  }
  </code></pre>
  
  <p>What do you think about it? I'm not an expert in security, and I'd be greatful if someone could give me a hint.</p>
  
  <p>Just one more thing: What's the better way to handle session to keep the users logged in?</p>
  
  <p>(sorry about the bad english, it's not my native language).</p>