Hashing and salting in a PDO prepared statement - hash

Question

Can someone show me the proper format to use for hashing and salting in a PDO prepared statement? I'm switching from php and trying to get this to work in a simple INSERT statement before worrying about the more complex functions, and nothing that I've seen online has worked.
In php I was doing this: '".sha1($salt + $_POST['password'])."'
I've tried:
$password = '123456';
$hash = hash('sha1', $password);
$pass1 = hash('sha1', $salt . $hash . $password);
$salt is defined in config.php, referenced correctly, and works properly in php insert statements.
EDIT -
This is the INSERT statement that I'm using:
$stmt = $conn->prepare('INSERT INTO customer_info (fname...) VALUES(:fname...)');
$stmt->bindParam(':fname', $_POST['fname'], PDO::PARAM_STR);
$stmt->execute();

Answer 1

Most database systems do not have decent passwort hash functions available, so you cannot generate the hash value with SQL. I'm not sure what you mean with "switching from PHP", but let the development language generate the hash, not the database system.
The salt should be different for every password, a global salt cannot fulfill it's purpose. Your "salt" is actually a key (or pepper), it is always the same. A salt has to be stored (plaintext) together with the hash-value, you need it to compare the stored hash with the hash of the entered password.
PHP 5.5 will have it's own functions password_hash() and password_verify() ready, to simplify generating BCrypt password hashes. I strongly recommend to use this excellent api, or it's compatibility pack for earlier PHP versions. Then i would invite you to read more about correct password storing with salt and pepper in this tutorial.
Edit:
Normally an insert with PDO looks something like this:
$password = $_POST['password'];
$hashedPassword = sha1($password . $salt);
$sql = 'INSERT INTO user (name, passwordhash) VALUES (?, ?)';
$sth = $pdo->prepare($sql);
$sth->execute(array('Jack Cornfield', $hashedPassword));
Of course your statement will look different, but i don't know your table and fields. In the example, the generation of the hash is done in pure PHP, and the resulting $hash is added parameterized to the sql statement with placeholders.