0

I looked around and couldn't really find a sufficient answer on this so I figured I'd ask the community what they thought was best.

I am looking at a registration/log in for with PHP and am wondering if it's secure to publish the password_hash and password_verify code to Github/GitLab/Git?

Any guidance on security standards would be greatly appreciated.

5
  • 5
    Are you not using the built in hash and verify functions? Those are already publicly known. If not then homemade ones are likely to be entirely insecure, so I'd suggest not. Tho without more info it's hard to say really
    – James
    May 7, 2018 at 18:49
  • 1
    Yeah, its fine, putting it in a public place is a good thing, though if you write bad code or present it without a readme, noone will look at it anyway, if its a nice project you may get contributors and/or someone points out SQL injection or XSS issues etc. Just don't put the config files which have access to your servers in, and obviously not db backups etc. May 7, 2018 at 19:03
  • Nope. I was planning on using PHP's built in hash/verify functions. I just couldn't find any articles that said if it was negligent to submit the used hashing algorithm when committing files to a git platform.
    – John
    May 7, 2018 at 19:03
  • James and Lawrence Cherone, thanks for the feedback. As stated in my previous comment, I just wanted to make sure it wasn't ridiculously negligent to commit the built-in php hash algorithm. Thanks again for your response! :)
    – John
    May 7, 2018 at 19:05
  • They're publicly known and documented in the PHP.net manual, blogs, forums, and a large presumption can be made that most sites will be using them now. No secret ;)
    – James
    May 8, 2018 at 10:36

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.