Use crypt() for password storage

Comparing #14 with #15

Revision #15 was created by fsb fsb on Nov 15, 2014, 6:00:22 PM.

missing base64_encode()

Content

[...]
From a user account generation form, assume that we have (already sanitized) user input in
`$form->email` and `$form->password`. We generate the hash:

$salt = openssl_random_pseudo_bytes(22);
$salt = '$2a$%13$' . strtr(base64_encode($salt), array('_' => '.', '~' => '/'));
$password_hash = crypt($form->password, $salt);

And insert a row into `user` containing `$form->email` and `$password_hash`.

At user logon assume we again have sanitized user input in `$form->email` and `$form->password`.
[...]