title: Does my PHP security algorithm effectively store user credentials?
body: <p>This question is about a specific programming problem I am having - I want to make sure that my code (and software algorithm) are sufficient enough to store user credentials in a database.</p>
  
  <pre><code>// Get a 32 character salt like '69Mt6nexL1rsjWnu011S53MpB/WmT4Vl'
  $passwordSalt = Security::generateBase64Salt();
  
  $user = new User();
  $user-&gt;setUsername($_POST['username']);
  
  // $_POST['password'] comes in as a 128 character string
  // Client side javascript is used to sha512 the string before sending it over POST
  // see http://pajhome.org.uk/crypt/md5/
  // This prevents novice eavesdroppers from capturing the raw password in plaintext
  $user-&gt;setPassword(
      hash('sha512', $passwordSalt.$_POST['password'])
  );
  $user-&gt;setPasswordSalt($passwordSalt);
  $user-&gt;save();
  </code></pre>
  
  <p>Here's the database entry for a particular password:</p>
  
  <p><img src="https://i.stack.imgur.com/tUxVK.gif" alt="alt text"></p>
  
  <p><strong>Password:</strong></p>
  
  <p>69a78a7586a111b8a567b2d4f42f93f01fb59d337f7fa3c35949a66b246095778c1fa01ff4026abace476091e1e9a183bbdec1c31b12ce3f786921895c98cf6f</p>
  
  <p><strong>Salt:</strong></p>
  
  <p>69Mt6nexL1rsjWnu011S53MpB/WmT4Vl</p>
  
  <p><strong>Questions:</strong></p>
  
  <ul>
  <li>Are there any inherit flaws with this algorithm?</li>
  <li>Is it OK to store the salt in the same database and table as the salt+password hash?</li>
  <li>Will having a large 128 character password cause login performance issues (on a magnitude of several seconds) if I have several hundred thousand users in the table?</li>
  <li>Can this data be reversed to produce the original password?</li>
  </ul>
  
  <p><strong>For Fun:</strong></p>
  
  <p>I'll PayPal you $5 if you can provide me with the original password using the salt and salt + password hash.</p>