How do I update my security in my login script from MD5 to something more secure?

Question

I have a PHP login script with salt on the database, but in my register script I see:

$qry = "INSERT INTO accounts(username, firstname, lastname, password) " . 
VALUES('$username','$fname','$lname','" . md5($_POST['password']) . "')";

and for the login:

$qry="SELECT * FROM accounts WHERE username='$username' AND password='" .
md5($_POST['password']) . "'";

Is there some code that can replace the MD5? Something more secure?

I've heard of SHA1 or something.

Answer 1

Short answer

Use bcrypt not md5 or sha1

Longer answer

Using the crypt() is hard. There is a new PHP password hashing API coming in PHP version 5.5, you can read about it here:

https://gist.github.com/nikic/3707231

It uses bcrypt and makes the whole process very easy. Of course php 5.5 isn't ready yet, so in the meantime there is a library to provide this new API right now:

https://github.com/ircmaxell/password_compat

Edit: See this thread for a much more thorough answer on the topic:

How do you use bcrypt for hashing passwords in PHP?