Re: Quickform with javascritp md5 loop

Nicolas de Bari Embriz Garcia Rojas wrote: >I am implementing the javascript md5 (http://pajhome.org.uk/crypt/ >md5/) with html_quickform if works fine but i have a problem doing a >registration form. > >The form ask for fields like firstname, lastname, email. password and >validate the input data but if for some reason the user submits the >data and the validation do not pass, the password field is been >hashed twice or more depending on how many errors/submits > >I start and place the onsubmit element this way: > >parent::HTML_QuickForm >('signupForm','post','','','onsubmit="javascript:password1.value=hex_sha > >1(password1.value), password2.value=hex_sha1(password2.value)"'); > > >if user for example types on the fist time password: aaa and then >submit the form, the password field would be sha1(aaa) but if the >validation form do not pass, if the user for example did not typed >correctly the email, then after writing the email correctly and >submitting the data again, password now will be sha1(sha1(aaa). > > >I would like to know if there is a way on html_quickform to not save >or unset the password values on the form when it is not verified , so >it does not metter how many errors the user can make, the password >field all ways will be sha(foo) and not sha1(sha1(sha1(etc etc etc). With your javascript, reset the password field to something like '******' and pass the sha1() value in another field that can be generated by your javascript or in an hidden field. The idea is to have 2 password field, one visible, one hidden. That's what PHPLib was doing a few years ago IIRC: <http://www.sanisoft.com/phplib/manual/auth_Response.php> Note that this method is not secure since you can always intercept the hash. SSL is more secure. WSSE authentication is also interesting: <http://www.xml.com/pub/a/2003/12/17/dive.html> -- Bertrand Mansion Mamasam Tel : +33 1 48 89 88 26 http://www.mamasam.com Creative Internet Solutions