+1 to prodigal_erik

Also concatenating "foo" to the end of /every/ password is not salting your hash. You need to have a suitably random string for it be considered salt. Also you want to have a different random string for every password in your database.

[+1 to tptacek for constantly saying don't write crypto code :-p]