Weak hash algorithm (ARCH7111)

Key php.security.weak-hash · Severity error · Category security · CWE CWE-328

MD5 and SHA-1 are cryptographically broken and prone to collisions. Using them for security purposes such as integrity or signing defeats the protection; SHA-256 or stronger should be used.

Incorrect

<?php
$digest = md5($payload);
$sig = sha1($secret . $payload);

Correct

<?php
$digest = hash('sha256', $payload);
$sig = hash_hmac('sha256', $payload, $secret);

Fix

For security hashing use SHA-256 or stronger instead of MD5/SHA-1; for message authentication use hash_hmac().