title: Update old stored md5 passwords in PHP to increase security
body: <p>At the moment I have a database with md5 passwords stored, a few years back this was considered a little more secure than it is now and it's got to the point where the passwords need to be more secure.</p>
  
  <p>I've read a lot of posts on here about <code>crypt</code>, <code>md5</code>, <code>hash</code>, <code>bcrypt</code>, etc and have come to consider using something along the lines of the following to 'secure' the passwords better than they are now.</p>
  
  <p>I will use a combination of <code>hash("sha512"</code> and two salts, the first salt will be a site wide salt stored in a file such as .htaccess and the second salt will be created for each user.</p>
  
  <p>Here's an example <strong>along the lines</strong> of what I'm testing at the moment:</p>
  
  <p>.htaccess</p>
  
  <pre><code>SetEnv SITEWIDE_SALT NeZa5Edabex?26Y#j5pr7VASpu$8UheVaREj$yA*59t*A$EdRUqer_prazepreTr
  </code></pre>
  
  <p>example.php</p>
  
  <pre><code>$currentpassword = //get password
  
  $pepper = getenv('SITEWIDE_SALT');
  $salt = microtime().ip2long($_SERVER['REMOTE_ADDR']);
  
  $saltpepper = $salt.$pepper;
  
  $password = hash("sha512", md5($currentpassword).$saltpepper);
  </code></pre>
  
  <p>The salt would obviously need to be stored in a separate table to allow checking of future inserted login passwords but it would never be possible for a user to see. Do you think this is a sufficient way to go about this?</p>