Next Generation Open Source LMS

Based on a suggestion by Ryan Govostes, I have implemented salted passwords. If the database is compromised by some sort of attack — SQL injection, or otherwise — the attacker will be unable to use a pre-made collision table.

Now, there is an application salt in addition to a per-user salt. The idea behind the application-wide salt is that if the database is compromised but the application data is not, it will be extremely difficult, if not impossible to generate collisions against the hashed passwords. The per-user salt is stored in the database and increases the complexity of collision-generation while not significantly affecting application performance.