title: Hashing & Salting - Validating login w/ cookies
body: <p>So this is basically a reassurance that I'm doing the whole registration/login process right as far as hashing/salting goes.</p>
  
  <p>I have a users table with the fields password, salt, token (obviously there are others but this is the most important). Upon registration it generate a random salt, and a random token, and it puts in the password field this:</p>
  
  <pre><code>hash("sha256", $theirpostpassword.$randomgeneratedsalt);
  </code></pre>
  
  <p>That random generated salt and token are stored in their respective fields in that users row in the table.</p>
  
  <p>So upon login I select the salt ONLY from the users row with the username they specified. I then do a count query of how many rows have their post password concatenated with their specific salt, and then I log them in. Pretty sure I have that part down.</p>
  
  <p>Now I was thinking to validate their login on every page I would have a function ran every page that checks their cookie to see if the format of id-username-token matches the row in the database. Meaning that every login it sets their cookie with those credentials.</p>
  
  <p>Now the only thing I can think of to make it better is change the token every valid login? </p>
  
  <p>Thanks for the insight guys.</p>