md5() or sha1() used
Why it matters
md5 and sha1 are fast, so leaked password hashes can be cracked at billions of guesses per second. password_hash() is deliberately slow and salted.
$hash = md5($password);$hash = password_hash($password, PASSWORD_DEFAULT);
// at login
if (password_verify($input, $hash)) {
// signed in
}How to fix
Fine for checksums, never for passwords. Use password_hash() and password_verify().
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.