Encoding a URL

b0r3d

Hey,

I am trying to encode a url within a php file. The php file contains a signup for so people may signup for free e-mail accounts. within the URL it looks something like this..

http://www.domain.com/signup.php?pass=password&username=username&newemail=email

You can see that when you view the source.... the signup form is a javascript auto forward and just runs the URL to setup the email through another site that controls my domain.

I am trying to be able to hide that url so no one can grab the password. Can someone help please.. if this is confusing to understand please let me know and i'll try my best to explain again.. the source to the file run after is below.. password and username obviously removed..

<?php

$len = strlen($NEWUSER);

if ($len < 4) {
echo "You must enter an email address longer then 4 chrs. You currently only have <b>$len</b>";
$continue=0;
}

if ($continue == "0") {
echo "Pleaes click <b>back</b> on your browser to fix this problem";
exit;
}

echo "<br></br>Please wait....<br></br><br>";

echo "<html>";
echo "<script src=http://www.web-mania.com/cgi-bin/controlemail1.cgi?Email=email&Pass=********&HOSTING_ID=1350&DOMAIN_NAME=domainname.com&addpop=1&NEWUSER=$NEWUSER&NEWPASS=$ALIAS&domainname.com></script>";
echo "Adding new account. $NEWUSER@domainname.com Password: $ALIAS";
echo "<META HTTP-EQUIV=Refresh CONTENT=\"0; URL=http://www.domainname.com/mail\">";
echo "</html>";

Hope the above is enough to understand..

Thanks,

b0r3d

sfhc

If what you mean is that you don't wnat hte password being passed as plain text in the url, then use one of php's encryption features.

Doing so has some implications though, primarily the 3rd party e-mail solution you are useing must accept the encrypted string, and secondly, the log in form must encrypt the password string before sending it to the database.

NiXXeD

I would say not to use URL passed variables in this situation (if possible?). At least with using POST things are hidden to most users. And just md5 everything before it gets used. When the user signs up, MD5 the password, and when they log in, md5 it before you use it and you can just compare the 2 md5'd pass's. That way the cache wont have any plaintext passwords lingering.

NiX