Re: Security Questions

Mark Lo wrote: > I would like to know how secure is $PHP_AUTH_USER and $PHP_AUTH_PASSWD. > Can third party observe it while in transmit ?? I believe that those to vars are set using HTTP authentication, and yes they are sent as plain text. You could use SSL though. Another interesting solution that doesn't involve SSL is used by PHPLIB. They use challenge/response auth using javascript to do MD5 on the client side. Very clever I thought. -- Simon Edwards Animated Design, Melbourne http://www.animated.net.au/ Ph: (03) 98850990