Password hashing

[Dgc2002]

As it stands passwords are "hashed"(actually encrypted), and very poorly at that. bin2hex is used which takes a string, converts it to hex, then returns an ASCII string of that hex. Seen here

Ignoring all issues surrounding this one I would suggest using password_hash and password_verify. Quick overview of password_hash:

• Takes a plain text password and hashes it using a strong one-way algorithm.
• As of PHP 5.5 bcrypt is the default algorithm. But both password_hash and password_verify are intended to be future-proof in that the default algo will change and be compensated for.
• Automatically salts the password/hash using /dev/urandom

here is a quick example.

[majiru]

Current working example in dev branch. Waiting for full implementation before I'll close.