When a user registers (creates a new account), I want to encrypt password before storing in a database, and when a user logs on (with username & password) I want to check password. I did it in the following way:

function password_encrypt($pass) {
 $hash_format = "2ドルy10ドル$"; // Tells PHP to use Blowfish with a "cost" of a 10
 $salt_length = 22; // Blowfish salts should be 22-characters or more
 $salt = generate_salt($salt_length);
 $format_and_salt = $hash_format . $salt;
 $hash = crypt($pass, $format_and_salt);
 return $hash;
}
function generate_salt($salt_length) {
 // Not 100% unique, not 100% random, but good enough for a salt
 // MD5 returns 32 characters
 $unique_random_string = md5(uniqid(mt_rand(), true));
 // Valid characters for a salt are [a-zA-Z0-9./]
 $base64_string = base64_encode($unique_random_string);
 // But not '+' which is valid in base64 encoding
 $modified_base64_string = str_replace('+', '.', $base64_string);
 // Truncate string to the correct length
 $salt = substr($modified_base64_string, 0, $salt_length);
 return $salt;
}
function password_check($password, $existing_hash) {
 // existing hash contains format and salt at start
 $hash = crypt($password, $existing_hash);
 if ($hash === $existing_hash) {
 return true;
 } else {
 return false;
 }
}

Can you do a review of this code, give some suggestions?

Also, I have one more question: Is it a good idea to use these functions as private methods of

• User Model Entity Class OR
• User Repository Class

or simply to have a file called functions.php and to put them there and to use them in controller?

When a user registers (creates a new account), I want to encrypt password before storing in a database, and when a user logs on (with username & password) I want to check password. I did it in the following way:

function password_encrypt($pass) {
 $hash_format = "2ドルy10ドル$"; // Tells PHP to use Blowfish with a "cost" of a 10
 $salt_length = 22; // Blowfish salts should be 22-characters or more
 $salt = generate_salt($salt_length);
 $format_and_salt = $hash_format . $salt;
 $hash = crypt($pass, $format_and_salt);
 return $hash;
}
function generate_salt($salt_length) {
 // Not 100% unique, not 100% random, but good enough for a salt
 // MD5 returns 32 characters
 $unique_random_string = md5(uniqid(mt_rand(), true));
 // Valid characters for a salt are [a-zA-Z0-9./]
 $base64_string = base64_encode($unique_random_string);
 // But not '+' which is valid in base64 encoding
 $modified_base64_string = str_replace('+', '.', $base64_string);
 // Truncate string to the correct length
 $salt = substr($modified_base64_string, 0, $salt_length);
 return $salt;
}
function password_check($password, $existing_hash) {
 // existing hash contains format and salt at start
 $hash = crypt($password, $existing_hash);
 if ($hash === $existing_hash) {
 return true;
 } else {
 return false;
 }
}

Can you do a review of this code, give some suggestions?

Also, I have one more question: Is it a good idea to use these functions as private methods of

• User Model Entity Class OR
• User Repository Class

or simply to have a file called functions.php and to put them there and to use them in controller?

When a user registers (creates a new account), I want to encrypt password before storing in a database, and when a user logs on (with username & password) I want to check password. I did it in the following way:

function password_encrypt($pass) {
 $hash_format = "2ドルy10ドル$"; // Tells PHP to use Blowfish with a "cost" of a 10
 $salt_length = 22; // Blowfish salts should be 22-characters or more
 $salt = generate_salt($salt_length);
 $format_and_salt = $hash_format . $salt;
 $hash = crypt($pass, $format_and_salt);
 return $hash;
}
function generate_salt($salt_length) {
 // Not 100% unique, not 100% random, but good enough for a salt
 // MD5 returns 32 characters
 $unique_random_string = md5(uniqid(mt_rand(), true));
 // Valid characters for a salt are [a-zA-Z0-9./]
 $base64_string = base64_encode($unique_random_string);
 // But not '+' which is valid in base64 encoding
 $modified_base64_string = str_replace('+', '.', $base64_string);
 // Truncate string to the correct length
 $salt = substr($modified_base64_string, 0, $salt_length);
 return $salt;
}
function password_check($password, $existing_hash) {
 // existing hash contains format and salt at start
 $hash = crypt($password, $existing_hash);
 if ($hash === $existing_hash) {
 return true;
 } else {
 return false;
 }
}

Can you do a review of this code, give some suggestions?

Also, I have one more question: Is it a good idea to use these functions as private methods of

• User Model Entity Class
• User Repository Class

or simply to have a file called functions.php and to put them there and to use them in controller?

When a user registers (creates a new account), I want to encrypt password before storing in a database, and when a user logs on (with username & password) I want to check password. I did it in the following way:

function password_encrypt($pass) {
 $hash_format = "2ドルy10ドル$"; // Tells PHP to use Blowfish with a "cost" of a 10
 $salt_length = 22; // Blowfish salts should be 22-characters or more
 $salt = generate_salt($salt_length);
 $format_and_salt = $hash_format . $salt;
 $hash = crypt($pass, $format_and_salt);
 return $hash;
}
function generate_salt($salt_length) {
 // Not 100% unique, not 100% random, but good enough for a salt
 // MD5 returns 32 characters
 $unique_random_string = md5(uniqid(mt_rand(), true));
 // Valid characters for a salt are [a-zA-Z0-9./]
 $base64_string = base64_encode($unique_random_string);
 // But not '+' which is valid in base64 encoding
 $modified_base64_string = str_replace('+', '.', $base64_string);
 // Truncate string to the correct length
 $salt = substr($modified_base64_string, 0, $salt_length);
 return $salt;
}
function password_check($password, $existing_hash) {
 // existing hash contains format and salt at start
 $hash = crypt($password, $existing_hash);
 if ($hash === $existing_hash) {
 return true;
 } else {
 return false;
 }
}

Can you do a review of this code, give some suggestions?

Also, I have one more question: Is it a good idea to use these functions as private methods of

• User Model Entity Class OR
• User Repository Class

or simply to have a file called functions.php and to put them there and to use them in controller?