How effective is it?

Question

PHP

Hello. I will make a reservation right away that I stumbled upon the function by accident.

$str = hash_hmac(HASH, $str, HASH_SECRET1);

        for ($i = 0; $i < 100; $i++) {
            $str = md5($str);
        }

I understand that first we hash $str with some reliable algorithm (let's say sha512) then we hash the resulting hash 100 more times with the md5 function (if I understood the cycle correctly)
Thanks in advance
PS
I twisted this idea a little and wrote this class

class security {

    function salt() {
        $chars = "qazxswedcvfrtgbnhyujmkiolp1234567890QAZXSWEDCVFRTGBNHYUJMKIOLP";
        $max = HASH_SALT;
        $size = StrLen($chars) - 1;
        $salt = null;
        while ($max--) {
            $salt.=$chars[rand(0, $size)];
        }
        return $salt;
    }

    public function NewHash5($str) {
        $salt = self::salt();
        $str = hash_hmac(HASH, HASH_SECRET3 . $str . $salt, HASH_SECRET1);

        for ($i = 0; $i < 100; $i++) {
            $str = hash('sha1', $str);
        }

        for ($i = 0; $i < HASH_REKURS; $i++) {
            $str = hash('whirlpool', HASH_SECRET3 . $str . $salt.HASH_SECRET2);
        }

        for ($i = 0; $i < 10; $i++) {
            $str = hash('haval128,3', $str);
        }

        for ($i = 0; $i < 10; $i++) {
            $str = hash('adler32', $str);
        }

        $return['hash'] = HASH_SECRET2 . $str;
        $return['salt'] = $salt;
        return $return;
    }

}

If you use a salt of 60 characters, then processing on the server takes 0.00152683
, I measure it with this piece of code

substr(microtime(true) - $_SERVER["REQUEST_TIME_FLOAT"], 0, 10)

Answer 1

bcrypt to the rescue.
// EDIT
Extremely inefficient.
// EDIT2
Generate a random string (instead of your salt function, adjust the length):
bin2hex(openssl_random_pseudo_bytes(21));

Answer 2

I'm not a cryptologist, but I think this is a crazy overhead. Better make the salting algorithm smarter.