There are several methods to make your login script secure. The most crucial step for that is obviously to escape strings using real_escape_string() function that varies from the PHP version. This will get you rid of some common SQL injection attacks via form or address bar.

Another thing you must make secure is the user password. When talking about PHP and database, anything that comes in our mind is md5 hashing and password encryption. The most basic step we use is to encrypt the user password while registering in the internet.

For example,

md5($password);

This will generate the md5 hash of any value replaced by the variable password. However the MD5 hashing is most secure since 1991 there are still some tools that keeps record of hashes of most dictionary words. For example, MD5decrypter.com.

For example try decrypting 5f4dcc3b5aa765d61d8327deb882cf99 in MD5decrypter.com

This will clearly show you an decrypted form of the hash : password.

This means that some common dictionary words can be decrypted because most people use dictionary words or easy to remember words as their passwords. Only few of them considers creating confusing but memorable password.

But using some tweaks in MD5 hash, you can encrypt the has with your own little algorithm.  For example, using salts.

$salt = “theSecurePass”;
$userpass = $_POST['pass'];
$md5pass = md5($salt . $userpass);

Using salts will redfine the algorithm of md5 hashing which is pretty much secure than usual md5 hashing.

But you must keep in mind that the $salt must be much more secured and not detectable.

Incase if you want another capsule of security you can add your own algorith to the salted MD5 hashes. This can be done by changing and replacing or swapping the values.

For example,

If the normal salted hash is 5f4dcc3b5aa765d61d8327deb882cf99 and some how the hacker get to know your salt then still you can have another layer of security.

5f4dcc3b5aa765d61d8327deb882cf99 can be replaced to 9965b5aa75f4dcc3d61882cf7deb

Notice how the bold characters are arranged.

To bring this to life I’ve used the function mb_substr(). The syntax is mb_substr($string, [starting character position number], [length of character].

Using mb_substr(myvalue, 3, 4) will select alue.

Use this technique wisely in your salted MD5 has as the following code does.

you can make it more complex and un-decodable until and unless your server is secure from external attacks.