No collision hash of email in php - php

Question

This question has been asked before, but a lot of the threads are very old.
I need to hash email addresses to store in my database. I later need to match a hash, so the hash needs to be the same each time for each unique email. is there a risk of same hash? collision with say md5() or hash() ? what is the recommended way these days (2021)
thanks in advance

Answer 1

As of PHP 7.2 you would use Argon2 like this:
password_hash('your_value', PASSWORD_ARGON2I);
PHP 7.3 comes with an improved algorithm:
password_hash('your_value', PASSWORD_ARGON2ID);
To compare a value to the hash you can just use password_verify like this:
if (password_verify($user_value, $stored_hash)) {
// valid
}
This is normally meant to check hashed passwords, but e-mail addresses can be handled the same way (e.g. for data protection reasons).
The Argon2 algorithm is explained in Wikipedia, the Installation is described on php.net.

Answer 2

It's very simple. The password_hash() is a replacement for md5().
But what you're talking about here is hashing an e-mail. E-mail is not the same as password.
You as administrator don't need to know user passwords in order to give the user access. However you will need to know the user e-mail if you want to send out newsletters, registration confirmation and even provide an option via e-mail to retrieve a lost access to user account. Neither of the above hashing options will help you with that. Because the above options destroy the original data and leave you with crumbs of it.
In any case the password_hash() is 60 characters give or take vs. the md5() of 32 characters. So the password_hash() is the safest option and md5() is long outdated and shouldn't be used. Collisions is not something you should be worried about for passwords. Because users can have same passwords and even same hash data. But since the data belonging to different accounts, without the correct username, the hash is useless for user login.
So it now all boils down to e-mail. That you can achieve using this simple encryption and decryption. In this case since the data is not destroyed and is preserved. That means there is no chance of a collision especially considering that each user should have a different e-mail. But even if the data is exactly the same, the hashing results will still be different each time. So you can't go wrong with this option.
function enc($data, $key, $mode=0){
$cipher = "aes-256-gcm";
if(in_array($cipher, openssl_get_cipher_methods())){
if(!$mode){ // encrypt
$ivlen = openssl_cipher_iv_length($cipher);
$iv = openssl_random_pseudo_bytes($ivlen);
$data = openssl_encrypt($data, $cipher, $key, $options=0, $iv, $tag);
$data = base64_encode($data.'::'.$iv.'::'.$tag);
}else{ // decrypt
list($data, $iv, $tag) = explode('::', base64_decode($data), 3);
$data = openssl_decrypt($data, $cipher, $key, $options=0, $iv, $tag);
}
}
return $data;
}
ENCRYPTING DATA: enc('DATA','KEY'); (where KEY could be a user password) => RETURNS: ENC_KEY
DECRYPTING DATA: enc('ENC_KEY','KEY',1); (where KEY could be a user password) => RETURNS: DATA