note 32258 deleted from function.md5 by danbrown

Note Submitter: paj at pajhome dot org dot uk ---- Hi, You can use the MD5 function in combination with a similar JavaScript function to protect user passwords for logins. The arrangement goes like this: When the user requests the login page, the server generates a random number. It stores this in a session variable as well as sending to the client. When the user clicks submit, JavaScript in the client computes md5(password + random). The server can also generate this hash, because it already knows the password and random number. It uses this to check that the user entered the correct password. The password has not been transmitted in the clear, and next login the random number will be different, so an attacker can't use a "replay attack". JavaScript MD5 is available here: http://pajhome.org.uk/crypt/md5/ Paul