Rules / PHP
SHIELD-PHP-012
Weak hashing algorithm for passwords
What it detects
md5 or sha1 is used to hash sensitive values such as passwords, which is cryptographically weak.
How to fix
Use password_hash() with PASSWORD_DEFAULT and verify with password_verify().
Vulnerable — Shield flags thisregister.php
<?php
// User registration — md5 is fast and unsalted: crackable at scale
$password = $_POST['password'];
$hash = md5($password);
$stmt = $pdo->prepare('INSERT INTO users (email, password_hash) VALUES (?, ?)');
$stmt->execute([$_POST['email'], $hash]);
Fixed — scans cleanregister.php
<?php
// password_hash applies bcrypt with a per-user salt automatically
$password = $_POST['password'];
$hash = password_hash($password, PASSWORD_DEFAULT);
$stmt = $pdo->prepare('INSERT INTO users (email, password_hash) VALUES (?, ?)');
$stmt->execute([$_POST['email'], $hash]);
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-012, the fixed one does not.