michaelward82

The new Secure Password Hashing API in PHP 5.5

The [RFC for a new simple to use password hashing API][rfc] has just been accepted for PHP 5.5. As the RFC itself is rather technical and most of the sample codes are something you should not use, I want to give a very quick overview of the new API:

Why do we need a new API?

Everybody knows that you should be hashing their passwords using bcrypt, but still a surprising number of developers uses insecure md5 or sha1 hashes (just look at the recent password leaks). One of the reasons for this is that the crypt() API is ridiculously hard to use and very prone to programming mistakes.

michaelward82

<?php

//add your server aliases here
$servers = array(
	"185.14.184.234" => "mcfly.bensmann.no",
	"185.14.184.xxx" => "another.server.com",
);

//this script is triggered by this command from the terminal or cron:
//echo "time=`uptime`&df=`df -h`" | curl -s -d @- http://domain.com/path/to/script.php

michaelward82

<%
  if !!local_assigns[:apply_css] and (classes = menu_branch_css(local_assigns)).any?
    css = "class='#{classes.join(' ')}'".html_safe
  end
  # dom_id DEPRECATED: REMOVE AT 1.1, serves no purpose same with css attributes 'first' and 'last'
  dom_id = "id='item_#{menu_branch_counter}'".html_safe if menu_branch.parent_id.nil?
-%>
<li<%= ['', css, dom_id].compact.join(' ').gsub(/\ *$/, '').html_safe %>>
  <%= link_to menu_branch.title, menu_branch.url -%>
  <% if ( (children = menu_branch.children unless hide_children).present? &&