php - How do I create and store md5 passwords in mysql -

probably newbie question but, ive been reading around , have found difficulty in understanding creation , storage of passwords. i've read md5/hash passwords best ways store them in database. however, how go creating passwords in first place?

so have login page user bob, , password bob123 - how 1. bobs password database begin (hashed) 2. how retrive , confirm hashed password?

thanks

first off md5 isn't greatest hashing method use try sha256 or sha512

that said lets use hash('sha256') instead of md5() represent hashing part of process.

when first create username , password hash raw password salt (some random characters added each password make them longer/stronger).

might coming in create user form:

$escapedname = mysql_real_escape_string($_post['name']); # use whatever escaping function db requires important. $escapedpw = mysql_real_escape_string($_post['password']);  # generate random salt use account $salt = bin2hex(mcrypt_create_iv(32, mcrypt_dev_urandom));  $saltedpw =  $escapedpw . $salt;  $hashedpw = hash('sha256', $saltedpw);  $query = "insert user (name, password, salt) values ('$escapedname', '$hashedpw', '$salt'); "; 

then on login it'll this:

$escapedname = mysql_real_escape_string($_post['name']); $escapedpw = mysql_real_escape_string($_post['password']);  $saltquery = "select salt user name = '$escapedname';"; $result = mysql_query($saltquery); # you'll want error handling in production code :) # see http://php.net/manual/en/function.mysql-query.php example #2 general error handling template $row = mysql_fetch_assoc($result); $salt = $row['salt'];  $saltedpw =  $escapedpw . $salt;  $hashedpw = hash('sha256', $saltedpw);  $query = "select * user name = '$escapedname' , password = '$hashedpw'; ";  # if nonzero query return successful login