"Use bcrypt" is the answer to all those things. Bcrypt includes a salt, which is stored along with the method in the hash string. Hashing is not the same as encryption, so there is no key involved.
$salt = '$2a$08$' . $random_data;
$hash = crypt($password, $salt);
(08 is the cost factor - you can change it, but 8 seemed reasonable in my tests.)
If you google bcrypt and php you'll find a very complex and large class for doing this. It's no longer necessary - current versions of PHP have it built in.