php - Salts: Hashed or plain text? -

i want store (random) salt next password in database. now, question is:

should store hashed or in plain text? there difference (more security, faster?)? how effort should put in creating random string?

sample code:

    //creating random salt     $saltchars = "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789!#$%&()*+,-./:;<=>?@[]^_`{|}~";      $salt = uniqid(rand(), true).str_shuffle($saltchars);     // or should salt hashed (md5 or sha512 more security)     // $salt = hash('sha512', uniqid(rand(), true).$staticsalt.str_shuffle($saltchars));     //create user (with salt & pepper) $sqlquery = "insert users (user, password, salt) values('$id','".hash('sha512', $staticsalt.$accesskey.$salt)."','".$salt."');";      $sqlresult = mysql_query($sqlquery);  

for record: login-script

    $sqlquery = "select salt users user='$id';";      $sqlresult = mysql_query($sqlquery);       if (mysql_num_rows($sqlresult) == 1) {       $salt = (mysql_fetch_array($sqlresult));  //check if password correct     $sqlquery = "select * users user='$id' , password='".hash('sha512', $staticsalt.$accesskey.$salt[0])."'";     $sqlresult = mysql_query($sqlquery);     unset($accesskey, $salt);      //check whether query successful or not     if($sqlresult) {     if(mysql_num_rows($sqlresult) == 1)          {echo 'login successfull';}         else {die('error: wrong user id/password');}     }    } 

i know there many, many, websites out there discussing pros & cons of salt. nobody answers if salt should encrypt or not - , nobody shows how code login script random (!) salts (saved in database did).

so php beginner have no idea if code secure or not? or if there tricks make faster or more streamlined... thanks!

since need salt compute password hash in login script, can't store hash of salt irreversible operation, i.e. original salt lost.

so i'm presuming you're asking whether hashing original salt obtained picking random string yields better salt. in case use of hashing function has nothing 'hashing', way generate longer, seemingly more random sequence. makes absolutely no sense, however, hashed salt still need stored in database - in plaintext if will!