note 7269 deleted from function.crypt by jimw

From: Date: Sat, 03 Nov 2001 18:17:34 +0000
Subject: note 7269 deleted from function.crypt by jimw
References: 1  Groups: php.notes 
Request: Send a blank email to php-notes+get-20370@lists.php.net to get a copy of this message
It seems that a lot of people don't understand the point of using one-way encryption. More importantly, a lot of web designers forget that PHP encryption is done entirely on the web server, not the client.</P> Point being, if your form has a password input option and the user clicks SUBMIT, the password is then sent _as plain text_ over the Internet to the web server where it is then encrypted for comparison against a password database.</P> Do _not_ use these types of functions to add security to a form unless you're using an SSL or TLS (etc.) encrypted session. The only potential way around this issue is for you to write a JavaScript program that does the hashing on the client side before being sent over the Internet (which would make this function unnecessary).</P> Remember: SSL!

« previous php.notes (#20370) next »