I know another term that will act as "an extra obstacle for people trying to recover the original value, though it does smell a little of security through obscurity. "

its called PEPPER


CAPTCHA : validus

perhaps he's a seasoned developer *rim shot*

I think this says it all:

Italian Proverb:

Give neither counsel nor salt till you are asked for it

and

Stephen King:

Talent is cheaper than salt. What separates the talented individual from the successful one is a lot of hard work.

I think we have agreement that the comments were the most WTFy part. So I fixed the comments:

<?php

   // Create a string-token that is

   // (a) impossible to predict and

   // (b) different for every request 

   // Both requirements are taken more seriously than is

   // usual for PHP code. Instead of half-assed, this will

   // be done fully-assed.

   function make_random_code() {

      // The characters from which the random code is made.

      // The string is called $salt because I read

      // a cryptography book once.

      $salt = "abcdefghijklmnopqrstuvwxyz0123456789";

      // Reinitialize the random generator every time through

      // because I bet it would otherwise start repeating

      // itself when I'm not looking.

      // Since srand expects an int, passing microtime()

      // directly would always get truncated to 0 and

      // that would be embarrassing.

      // Use double-size math because we care deeply

      // about the precision of our random numbers.

      srand((double)microtime()*1000000);



      // Make a random string, 7 characters long

      $i = 0;

      while ($i <= 7) {

         // Generate a random number suitable for indexing

         // $salt. Use a simple modulo because we're not

         // really serious about the whole random thing,

         // so it doesn't matter that the resulting

         // distribution is skewed towards 0.

         // Also, calling rand(0, 32) seemed too complicated.

         // Use modulo 33 because $salt is 36 characters

         // long and the numbers 7, 8 and 9 traumatized me

         // when I was young.

         $num = rand() % 33;

         // Extract the somewhat-randomly chosen

         // character from $salt.

         $tmp = substr($salt, $num, 1);

         // Building strings one character at a time

         // builds character.

         $random_code = $random_code . $tmp;

         $i++;

      }

      return $random_code;

   }



   // Make sure it doesn't throw an error

   // like the last time I edited it.

   // Also, it would be a pity to leave

   // without polluting the global namespace.

   $random = make_random_code();

?>