If I correctly understand what ranko84 is on about, this would be a simpler function with roughly the same result.
<?php
function obscure($password, $algorythm = "sha1")
{
// Get some random salt, or verify a salt.
// Added by (grosbedo AT gmail DOT com)
if ($salt == NULL)
{
$salt = hash($algorythm, uniqid(rand(), true));
}
// Determine the length of the hash.
$hash_length = strlen($salt);
// Determine the length of the password.
$password_length = strlen($password);
// Determine the maximum length of password. This is only needed if
// the user enters a very long password. In any case, the salt will
// be a maximum of half the end result. The longer the hash, the
// longer the password/salt can be.
$password_max_length = $hash_length / 2;
// Shorten the salt based on the length of the password.
if ($password_length >= $password_max_length)
{
$salt = substr($salt, 0, $password_max_length);
}
else
{
$salt = substr($salt, 0, $password_length);
}
// Determine the length of the salt.
$salt_length = strlen($salt);
// Determine the salted hashed password.
$salted_password = hash($algorythm, $salt . $password);
// If we add the salt to the hashed password, we would get a hash that
// is longer than a normally hashed password. We don't want that; it
// would give away hints to an attacker. Because the password and the
// length of the password are known, we can just throw away the first
// couple of characters of the salted password. That way the salt and
// the salted password together are the same length as a normally
// hashed password without salt.
$used_chars = ($hash_length - $salt_length) * -1;
$final_result = $salt . substr($salted_password, $used_chars);
return $final_result;
}
?>