title: Password hash flow - especially reset password
body: <p>I'm updating the way I store passwords on my sites and want to share my flow thoughts to make sure I do it right:</p>
  
  <p>Firstly a user will choose a password which I'll hash:</p>
  
  <pre><code>function generateHash($password) {
      if (defined("CRYPT_BLOWFISH") &amp;&amp; CRYPT_BLOWFISH) {
          $salt = '$2y$11$' . substr(md5(uniqid(rand(), true)), 0, 22);
          return crypt($password, $salt);
      }
  }
  
  $passToStore = generateHash($userPassword);
  </code></pre>
  
  <p>Then I am going to store this in a table purely for password with the auto generated <code>userId</code> from users table as the key:</p>
  
  <pre><code>userId INT
  hashedPassword VARCHAR(22)
  forgottenHash VARCHAR(36)
  </code></pre>
  
  <p>When a user then returns and tries to login, I will extract the password in a join select query from the email (username) they enter. Then check that matches what they enter:</p>
  
  <pre><code>function verify($passwordEntered, $hashedPasswordStored) {
      return crypt($passwordEntered, $hashedPasswordStored) == $hashedPassword;
  }
  </code></pre>
  
  <p>If a user forgets their password, they enter their email address and I will generate a random hash and make it unique adding <code>strtotime</code> current time/date (to go into <code>forgottenHash</code>) and then send a link for them to click with their email and that random hash as the key and in the URL.</p>
  
  <p>If they click the link and the hash matches the user with that email address I'll delete the hashed password stored and let them create a new one. I'm concerned with the thought process for resetting password but it seems right to me. But then I'm not a hacker.</p>
  
  <p>Is this a good way to manage passwords or is there a better way?</p>