O_o
Well, just in case you come back or for others trying on a similar problem:
The current recommended minimum length for a salt is 16 bytes; in practice it is better to use as much as possible without pushing beyond the yield of the algorithms employees.
The salt must not be an "nonce" from your database implementation (It is to easy to parallelize an attack given the documentation of such features.); use a cryptographically secure "PRNG" to create the salt.
The salt must be unique to a password.
Do not use any simple algorithm such as "MD5", "SHA", or "Blowfish" to generate the hash. Actually, it is better not to use a hash function at all; consider using modern algorithms designed to circumvent parallelism by trumping how such hardware behaves (I recall "scrypt" but may be thinking of "bcrypt".).
Do not attempt to code such an algorithm yourself.
Soma
