title: Secure hash and salt for PHP passwords
body: <p>It is currently said that MD5 is partially unsafe. Taking this into consideration, I'd like to know which mechanism to use for password protection.</p>
  
  <p>This question, <a href="https://stackoverflow.com/questions/348109/is-double-hashing-a-password-less-secure-than-just-hashing-it-once">Is “double hashing” a password less secure than just hashing it once?</a> 
  suggests that hashing multiple times may be a good idea, whereas <a href="https://stackoverflow.com/questions/55862/how-to-implement-password-protection-for-individual-files#55904">How to implement password protection for individual files?</a> suggests using salt.</p>
  
  <p>I'm using PHP. I want a safe and fast password encryption system. Hashing a password a million times may be safer, but also slower. How to achieve a good balance between speed and safety? Also, I'd prefer the result to have a constant number of characters.</p>
  
  <ol>
  <li>The hashing mechanism must be available in PHP</li>
  <li>It must be safe</li>
  <li>It can use salt (in this case, are all salts equally good? Is there any way to generate good salts?)</li>
  </ol>
  
  <p>Also, should I store two fields in the database (one using MD5 and another one using SHA, for example)? Would it make it safer or unsafer?</p>
  
  <p>In case I wasn't clear enough, I want to know which hashing function(s) to use and how to pick a good salt in order to have a safe and fast password protection mechanism.</p>
  
  <p><em>Related questions that don't quite cover my question:</em></p>
  
  <p><a href="https://stackoverflow.com/questions/157998/whats-the-difference-between-sha-and-md5-in-php">What's the difference between SHA and MD5 in PHP</a><br>
  <a href="https://stackoverflow.com/questions/30946/simple-password-encryption">Simple Password Encryption</a><br>
  <a href="https://stackoverflow.com/questions/198803/secure-methods-of-storing-keys-passwords-for-asp-net">Secure methods of storing keys, passwords for asp.net</a><br>
  <a href="https://stackoverflow.com/questions/205153/how-would-you-implement-salted-passwords-in-tomcat-5-5">How would you implement salted passwords in Tomcat 5.5</a></p>