编辑2017/11/09：请务必查看O Jones的回答。
首先，MD5并不是您可以在此尝试使用的最出色的哈希方法sha256或sha512
就是说让我们使用
hash('sha256')而不是md5()代表流程的哈希部分。
首次创建用户名和密码时，您将使用一些盐对原始密码进行哈希处理（在每个密码中添加了一些随机的额外字符，以使它们变长/变强）。
可能看起来像这样，来自创建用户表单：
$escapedName = mysql_real_escape_string($_POST['name']); # use whatever escaping function your db requires this is very important.$escapedPW = mysql_real_escape_string($_POST['password']);# generate a random salt to use for this account$salt = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));$saltedPW = $escapedPW . $salt;$hashedPW = hash('sha256', $saltedPW);$query = "insert into user (name, password, salt) values ('$escapedName', '$hashedPW', '$salt'); ";然后在登录时，它将类似于以下内容：
$escapedName = mysql_real_escape_string($_POST['name']);$escapedPW = mysql_real_escape_string($_POST['password']);$saltQuery = "select salt from user where name = '$escapedName';";$result = mysql_query($saltQuery);# you'll want some error handling in production pre :)# see http://php.net/manual/en/function.mysql-query.php Example #2 for the general error handling template$row = mysql_fetch_assoc($result);$salt = $row['salt'];$saltedPW = $escapedPW . $salt;$hashedPW = hash('sha256', $saltedPW);$query = "select * from user where name = '$escapedName' and password = '$hashedPW'; ";# if nonzero query return then successful login
