OK, let's break down what you need into actionable steps. As premiso stated I would suggest using a salted hash so if someone was able to get your hashed values they can't use a lookup table to determine the passwords. A salt is just some manner of modifying the value in a consistent manner before hashing. By creating a value that is not 'common' it makes it significantly less likely that someone would have the value in a lookup table. You can salt a value by appending a value (such as the username), reversing the string, or anything that you can consistently replicate.
So, here are the steps I would take:
1) Create a function to generate a salted hashed password.
2) Create a simple PHP page to run that function on all the current passwords (see caution below)
3) Modify the user creation script to hash the password (using the above function) before doing the SQL Insert
4) Modify the login script to hash to provided password (using the above function) before comparing it against the value in the database.
Example hashing function: appends the username to the passoword before hashing to prevent the use of lookup tables if someone got a hold of the value. You could also do something such as reverse the characters of the string or anything that you can consistently reproduce but will result in a value that would not be 'common'.
function hashPW($password, $username)
{
return sha1($password.$username);
}
Sample function to update current records (note this may take a while if you have a LOT of records)
//Be sure to include the hash function!
$query = "SELECT id, username, password FROM users";
$result = mysql_query($query);
$values = array();
while ($record = mysql_fetch_assoc($result))
{
$query = "UPDATE users
SET password ='" . hashPW($record['password'], $record['username']) . "'
WHERE id = {$record['id']}";
mysql_query($query);
}
You should test this to ensure it works before running. Plus, you might want to backup your database first. It would be bad news if the script fails and you could not return the values to their original values. You could also insert the hashed value into a temporary column.
Update the login script to hash entered password before comparing against the db value.
--No code provided
Update the Registration script to hash the password
-Change this
// insert the data
$insert = mysql_query("insert into $table values ('NULL', '".$_POST['username']."', '".$_POST['password']."', '".$_POST['email']."')")
or die("Could not insert data because ".mysql_error());
-To this
$password = hashPW($_POST['password'], $_POST['username']);
// insert the data
$insert = mysql_query("insert into $table values ('NULL', '{$_POST['username']}', '{$password}', '{$_POST['email']}')")
or die("Could not insert data because ".mysql_error());
Lastly, you do not need to worry about protecting the password against sql injection since you are hashing the value - but you definitly want to use mysql_real_escape_string() for the username and email.
