title: Storing passwords with sha1 and salt
body: <p>I have a simple registration script done in php and I was just curious if the way I am doing it is secure enough to store user passwords. I am generating a 32bit random salt and appending it to an sha1 hashed password. </p>
  
  <pre><code>//create new validator object
      $validator = new data_validation();
      //validate user input
      $firstName = $validator-&gt;validate_fname($firstName); //is the first name a string?
      $lastName = $validator-&gt;validate_lname($lastName); // is the last name a string?
      $username = $validator-&gt;validate_username($username); // is the username a string?
      $email = $validator-&gt;validate_email($email); //is the email in valid format?
  
      //make sure there isn't duplicate emails
      $valQuery = $link-&gt;query("SELECT email FROM users WHERE email = '" .$email. "'");
  
      if ($valQuery-&gt;num_rows == 1) {
          echo "An email is already registered with that address";
          return false;
      }
  
      // generate a random salt for converting passwords into sha1
      $salt = $link-&gt;real_escape_string(bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM)));
      $saltedPW =  $password . $salt;
      $hashedPW = sha1($saltedPW);
  
      mysqli_connect($db_host, $db_user, $db_pass) OR DIE (mysqli_error());
      // select the db
      mysqli_select_db ($link, $db_name) OR DIE ("Unable to select db".mysqli_error($db_name));
  
       // our sql query
      $sql = "INSERT INTO users (first_name, last_name, username, email, password, salt) VALUES ('$firstName', '$lastName', '$username', '$email', '$hashedPW', '$salt');";
  
      //save the updated information to the database          
      $result = mysqli_query($link, $sql) or die("Error in Query: " . mysqli_error($link));
  
      if (!mysqli_error($link)) 
      {
          $row = mysqli_fetch_assoc($result);
          $_SESSION['user_id'] = $row['user_id'];
          $_SESSION['loggedin'] = TRUE;
          header("Location: ../home");
      }
  </code></pre>
  
  <p>Also, I am using a combination of procedural and oop php. Most of it is done in procedural, but there are a few oop classes such as the validation class you see used in the above script. Will this cause any performance issues using both styles?</p>