salting your passwords is another measure. as for hashing, MD5 may work for most cases but 'Secure hashing Algorithm' (ie. SHA-1) is supposedly more difficult to break. Since it's a difference between calling md5(string) and sha1(string) it's not difficult to use in php.
Another general idea is to try to keep data secure over the wire to avoid 'man in the middle' attacks. Sending sensitive information (like a plain-text password) straight from the client to the server is another vulnerability. here's an example for doing a 'secure' login if the server knows the user's password [more applicable for a client like an online game app]:
1. client asks server to login.
2. server 'challenges' the client by sending them a random number. the server remembers this number. Let's say the number was '123'.
3. the client takes '123' and takes their password (lets say it's 'foo') and hashes the combination (ie md5('123foo')).
4. server receives this hash. server grabs their copy of the password and number and creates the same hash. if it checks out, then everything is OK!
advantage? the password is never sent in plain text over the wire. And if someone did get the hash, it would be useless because the 'key' to login changes every time (the random number).
Anyway, the above may be overkill for a simple website, just throwing that info out there :)
Another general idea is to try to keep data secure over the wire to avoid 'man in the middle' attacks. Sending sensitive information (like a plain-text password) straight from the client to the server is another vulnerability. here's an example for doing a 'secure' login if the server knows the user's password [more applicable for a client like an online game app]:
1. client asks server to login.
2. server 'challenges' the client by sending them a random number. the server remembers this number. Let's say the number was '123'.
3. the client takes '123' and takes their password (lets say it's 'foo') and hashes the combination (ie md5('123foo')).
4. server receives this hash. server grabs their copy of the password and number and creates the same hash. if it checks out, then everything is OK!
advantage? the password is never sent in plain text over the wire. And if someone did get the hash, it would be useless because the 'key' to login changes every time (the random number).
Anyway, the above may be overkill for a simple website, just throwing that info out there :)