I remember a while ago hearing about a few theoretical collisions of the md5 algorithm, but I thought nothing of them. Now, as more information emerges, Microsoft is issuing advisories, and people are proving more and more collisions with example code, and even md5 is out of vista, I figure its time to remind everyone not to use md5.
What should I do?
First of all – lets use sha1 instead – equally as easy of a function to use – but much more secure.
1 |
Output:
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
Next, disable it in php using disable_functions in your php.ini
php.ini excerpt
disable_functions = md5
Finally, don’t accidentally use it in your db 
Interesting article. I agree with you that md5 should not be used for securing data because of the possibilities of collisions etc, but there are many other uses for md5 hashes.
If you need to convert some data to a hash, use sha1 or encrypt it with mcrypt. If all you need is a hash for a temporary unique id, md5 is just fine.
I wouldn’t just stop using it altogether.