密码

直接 md5 和 sha1 不安全！！！

crypt() 和hash_equals()：
http://php.net/manual/zh/function.crypt.php

<?php
// crypt()和hash_equals()
$pwds = ['123456', '123456', '123456', 'aaa', '_123456789zxcvbnmasdfghjklqwertyuiop'];
function get_random_bytes($size){
  return function_exists('random_bytes') ? random_bytes($size) : mcrypt_create_iv($size);
}
function get_salt($size){
  return substr(strtr(base64_encode(get_random_bytes(32)), '+', '.'), 0, $size);
}
/**
MD5：12位的salt，只有8位随机（$1$ + 8位 + $）
*/
$t_s = microtime(true);
foreach ($pwds as $key => $pwd) {
  $t1 = microtime(true);
  $hashed_pwd = crypt($pwd, '$1$'.get_salt(8));
  $t2 = microtime(true);
  var_dump($pwd, $hashed_pwd);
  if (hash_equals($hashed_pwd, crypt($pwd, $hashed_pwd))) {
      echo 'Password is valid!';
  } else {
      echo 'Invalid password.';
  }
  $t3 = microtime(true);
  var_dump($t2-$t1, $t3-$t2);
  echo "<hr>";
}
$t_e = microtime(true);
$t = $t_e - $t_s;
echo "一共 $t 秒";

password_hash() 和password_verify()（挺慢的，做安全需求非常高的时候用。。）：
http://php.net/manual/zh/function.password-hash.php

<?php
// password_hash()和password_verify()
$pwds = ['123456', '123456', '123456', 'aaa', '_123456789zxcvbnmasdfghjklqwertyuiop'];
/**
 * 我们想要使用默认算法散列密码
 * 当前是 BCRYPT，并会产生 60 个字符的结果。
 *
 * 请注意，随时间推移，默认算法可能会有变化，
 * 所以需要储存的空间能够超过 60 字（255字不错）
 */
$t_s = microtime(true);
foreach ($pwds as $key => $pwd) {
  $t1 = microtime(true);
  $hashed_pwd = password_hash($pwd, PASSWORD_DEFAULT);
  $t2 = microtime(true);
  var_dump($pwd, $hashed_pwd);
  if (password_verify($pwd, $hashed_pwd)) {
      echo 'Password is valid!';
  } else {
      echo 'Invalid password.';
  }
  $t3 = microtime(true);
  var_dump($t2-$t1, $t3-$t2);
  echo "<hr>";
}
$t_e = microtime(true);
$t = $t_e - $t_s;
echo "一共 $t 秒";

token 和 sale

http://php.net/manual/zh/function.random-bytes.php#118932
I used below function to create random token, and also a salt from the token. I used it in my application to prevent CSRF attack.

<?php
function RandomToken($length = 32){
    if(!isset($length) || intval($length) <= 8 ){
      $length = 32;
    }
    if (function_exists('random_bytes')) {
        return bin2hex(random_bytes($length));
    }
    if (function_exists('mcrypt_create_iv')) {
        return bin2hex(mcrypt_create_iv($length, MCRYPT_DEV_URANDOM));
    }
    if (function_exists('openssl_random_pseudo_bytes')) {
        return bin2hex(openssl_random_pseudo_bytes($length));
    }
}

function Salt(){
    return substr(strtr(base64_encode(hex2bin(RandomToken(32))), '+', '.'), 0, 44);
}

echo (RandomToken());
echo "<hr>";
echo Salt();
echo "<hr>";

/*
This function is same as above but its only used for debugging
*/
/*
function RandomTokenDebug($length = 32){
    if(!isset($length) || intval($length) <= 8 ){
      $length = 32;
    }
    $randoms = array();
    if (function_exists('random_bytes')) {
        $randoms['random_bytes'] = bin2hex(random_bytes($length));
    }
    if (function_exists('mcrypt_create_iv')) {
        $randoms['mcrypt_create_iv'] = bin2hex(mcrypt_create_iv($length, MCRYPT_DEV_URANDOM));
    }
    if (function_exists('openssl_random_pseudo_bytes')) {
        $randoms['openssl_random_pseudo_bytes'] = bin2hex(openssl_random_pseudo_bytes($length));
    }

    return $randoms;
}
echo "\n";
print_r (RandomTokenDebug());

?>
*/