Re: Sequrity without HTTPS?
| From: | fabien champel | Date: | Fri, 19 Nov 2004 21:43:24 +0000 |
| Subject: | Re: Sequrity without HTTPS? | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-202540@lists.php.net to get a copy of this message | ||
you can fint sha1 and md5 functions in javascript here :
http://pajhome.org.uk/crypt/md5/index.html
______________________________
example :
before <html>
<?php
session_start();
if ( function_exists("session_regenerate_id") ) session_regenerate_id();
$l = &$_POST["login"];
$p = &$_POST["pass"];
$lemd5 = md5("1234".$_SESSION["str"]);
if ( isset($l) && $l=="login" && isset($p) && $p == $lemd5 ){
$logged = true;
unset($_SESSION["str"]);
} else {
srand(time());
$myStr = sha1( rand() );
$_SESSION["str"] = $myStr;
$logged = false;
}
?>
in head :
<?php if ( !$logged ) { ?>
<script type="text/javascript" src="md5.js"></script>
<script type="text/javascript">
function goForm(){
val = document.formul.pass.value;
md5 = hex_md5(val+"<?php echo $myStr; ?>");
document.formul.pass.value = md5;
document.formul.action = "index.php";
document.formul.submit();
}
</script>
<?php } ?>
and in body
<?php if ( !$logged ) { ?>
<form method="POST" action="javascript:goForm()" name="formul">
<input type="text" name="login" id="login" /><br />
<input type="password" name="pass" id="pass" /><br />
<input type="submit" value="envoyer" />
</form>
<?php } else { ?>
ok ;)
<?php } ?>
i hope that it can be useful :-)