php - How do I securely store hashes? -

when user wants password reset, email sent unique url can reset it. this: website.com/forgot.php?email'.$email.'&hash='.$thehash

$thehash unique hash every user stored in database.

the problem $thehash stored in database way it´s used in url. that´s stupid storing passwords in plain text. if get´s access database doesn't matter have passwords stored sha512 , secure salt, attacker can access account using values (email , hash) found in database , change passwords users.

when hashed user passwords user had 1 part of information not found in database, plaintext password worked out. now, have no idea since have nothing unique not found in database. way solve this? how securely store hashes?

the problem isn't how you're storing hashes, it's how reset link works.

you don't want use hash authenticate user password resets, reasons mentioned.

use perishable token instead. whenever user requests password reset, generate token (256-bit should enough) , store hash in database, along user requested it, , token creation datetime. put token in reset link (instead of email+hash). when user clicks link, server receive token, find corresponding user , it'll safe change password.

by storing token's hash in database, using unhashed token in email link, you're making sure if attacker still has access database, won't able forge own reset links.

by comparing time when user clicked link datetime stored when token generated, you'll able control how long reset link valid (and avoid situations user forgets delete email, gets email account compromised, , have attacker use reset link).

check authlogic password reset tutorial full implementation.