Password Encryption Strategy

[zhorton34]

• Update Password Encryption Strategy

Currently we are storing sha1 hash of the password.
Then, on login, we are comparing the hash of the submitted password with the database column.

This isn't a good idea because unsalted hashes are vulnerable to rainbow tables, and sha1 is not a good choice because it's a fast hash.

PHP has good built-in functions that handle this securely, here is some info:

https://phptherightway.com/#password_hashing https://paragonie.com/blog/2017/12/2018-guide-building-secure-php-software#secure-php-passwords