title: How do you securely store a user's password and salt in MySQL?
body: <p>So, I found out on SO that you're supposed to hash the password together with a "salt". (The articles can be found <a href="https://stackoverflow.com/questions/6879706/securely-hash-passwords-so-much-conflicting-advice/6879902">here</a> and <a href="https://stackoverflow.com/questions/401656/secure-hash-and-salt-for-php-passwords">here</a>.)</p>
  
  <p>Here's the code:</p>
  
  <pre><code>$password = 'fish';
  
  /* should be "unique" for every user? */
  $salt= 'ABC09';
  
  $site_key = 'static_site_key';
  
  hash_hmac('sha1', $password . $salt, $site_key);
  </code></pre>
  
  <p>And now I need to save both the <code>$password</code> and <code>$salt</code> in MySQL, like so:</p>
  
  <pre><code>+---------+--------+----------+-------+
  | user_id |  name  | password |  salt |
  +---------+--------+----------+-------+
  |    1    | krysis |  fish**  | ABC09 |
  +---------+--------+----------+-------+
  </code></pre>
  
  <p>** <code>fish</code> will of course be hashed and not stored in plain text.</p>
  
  <p>And I'm just wondering whether or not it actually makes sense to do it this way, because this way a hacker or whoever will also know the salt? So, if they crack the password and the see it's <code>fishABC09</code> they automatically will know the password is <code>fish</code>? Or might he "never" be able to crack the password because he doesn't know the <code>secret_key</code>, as it isn't stored in the database?</p>
  
  <p>I'm sorry if I'm not making any sense. I just always used <code>sha1</code> for passwords, and today I found these articles that talked about adding a <code>salt</code>.</p>