[Resolved] Sending login/pass secure ??

Tomz

Hi!

Just curious about this, maybe someone knows...

I am using a form which asks the user for a username and password. This form calls a php file which validates the username and password.

I use POST as form method so when the form is submitted the username and password are not displayed in the url to the php file.

I can imagine that the username/password can be intercepted by a third party while sent over the internet when calling the php file, even when I am using the POST method.

Is it smart and possible to somehow md5 the username/password before it is sent to the php file?
How would I do such a thing?

I know how to md5 things but how do I put that in the <input> tag?


<input type="password" name="password">

Thanks!

Tom

yuraupt

To implement your idea you have to apply md5 function on the login and password values before sending them over the internet. Right? In other words it should be don on the client side. You can do it with Javascript.

go to www.google.com and search for "Javascript MD5".

Once you have MD5 function in Javascript, you can do the following.

function EncryptFrom would look like:

It's better to put this script in the Head. Implementtion of MD5String you should pick up somewhere on the net.

Another way to send the data securely is using https protocol.

Tomz

Thanks yuraupt!!

It worked.

For others that may be searching in this forum on how to get this done...

First, go to

http://pajhome.org.uk/crypt/md5/

There you can download the javascriptcode for MD4, MD4 and SHA1.

I just downloaded the md5 file because this is the only one I need. You can use any or all of them if you like.
Follow the instructions on this website. Very easy, a kid could do it.

Below is my form to serve as an example.

<html>

<head>

<script language="JavaScript" src="md5.js"></script>

<script language="JavaScript">

function EncryptFrom(the_form){
	the_form.username.value = hex_md5(the_form.username.value);
	the_form.password.value = hex_md5(the_form.password.value);
	}

</script>

</head>

<body>

<form action="login.php" name="loginform" onSubmit="EncryptFrom(this)">
    <input type="text" name="username">
	<input type="password" name="password">
	<input type="submit" name="login" value="login">
</form>



</body>

</html>