Do not use weak or generic hash algorithms (like MD5 or SHA1) for storing passwords. Use built‐in functions like password_hash() (with BCRYPT or Argon2) and password_verify(), which handle salting and secure algorithms automatically.
Old hash algorithms are vulnerable to brute‐force attacks and rainbow tables, making it easier to crack passwords. Modern password‐hashing functions include salts and iteration counts, making stored passwords much harder to compromise.
Side-by-side examples engineers can pattern-match during review.
<?php
$password = $_POST['senha'];
$hash = md5($password);
// store $hash in database
?><?php
$password = $_POST['senha'];
$hash = password_hash($password, PASSWORD_DEFAULT);
// store $hash in database
?><?php
$password = $_POST['senha'];
$hash = md5($password);
// store $hash in database
?><?php
$password = $_POST['senha'];
$hash = password_hash($password, PASSWORD_DEFAULT);
// store $hash in database
?>From the same buckets as this rule.