Some people like to add "pepper" in addition to salt. Salt would be a unique value that's combined with each password. Pepper is a global secret combined with the unique salt, that is not stored near the passwords (e.g. stored in a config file). The idea being in an sql injection, you can typically dump the entire db but not config files or anything else. Of course if they totally take over your server you are still just as screwed, and if you have sql injections you likely have other vulns too.

https://en.m.wikipedia.org/wiki/Pepper_(cryptography)