[Vince]

It's fine. Use salts for extra security. The salt should be at least as long as the hash itself (so 256 bits, 64 characters), it should be randomly generated and it should be unique for each player. That should provide sufficient protection. Until the player uses the password 123456 ...

Edit: as for Whirlpool: this requires an extra plugin. You've got a native implementation of SHA2 at your disposal. You might as well use it. And it even comes with a built in salting algorithm.