title: How to use AES_ENCRYPT properly?
body: <p>I'm trying to use AES encryption (<a href="http://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html#function_aes-encrypt" rel="nofollow">AES_ENCRYPT</a> in MySQL) for user passwords but I came up with a bunch of different problems.</p>
  
  <p>This is the SQL query that I use to store a new user into the database:</p>
  
  <pre><code>INSERT INTO user VALUES (
      '15',
      'John',
      'Doe',
      '123 Fake St.',
      AES_ENCRYPT('mypassword', 'mysalt'),
      'mysalt'
  )
  </code></pre>
  
  <p>Where the salt would be a random string in a real case.</p>
  
  <p>It works fine. I mean, I'm able to retrieve the original password. In this example, <code>AES_DECRYPT(user.password, 'mysalt') WHERE user.id = 15</code> retrieves <code>mypassword</code>. But I might be overlooking some things.</p>
  
  <ul>
  <li><p>Is it secure to save the salt along with the password? Aside from <a href="http://en.wikipedia.org/wiki/Security_through_obscurity" rel="nofollow">security through obscurity thing</a>.</p></li>
  <li><p>What is the best format to store the hashed password? I'm using<br>
  VARBINARY but the stored string looks like <code>8�p�����_�Z�\</code>.</p></li>
  <li><p>And finally, how long should the password be and how long should the 
  salt be?</p></li>
  </ul>
  
  <p>Thanks</p>