note 7269 deleted from function.crypt by jimw
| From: | jimw@php.net | Date: | Sat, 03 Nov 2001 18:17:34 +0000 |
| Subject: | note 7269 deleted from function.crypt by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-20370@lists.php.net to get a copy of this message | ||
It seems that a lot of people don't understand the point of using one-way encryption. More
importantly, a lot of web designers forget that PHP encryption is done entirely on the web server,
not the client.</P>
Point being, if your form has a password input option and the user clicks SUBMIT, the password is
then sent _as plain text_ over the Internet to the web server where it is then encrypted for
comparison against a password database.</P>
Do _not_ use these types of functions to add security to a form unless you're using an SSL or
TLS (etc.) encrypted session. The only potential way around this issue is for you to write a
JavaScript program that does the hashing on the client side before being sent over the Internet
(which would make this function unnecessary).</P>
Remember: SSL!