Re: login form

Toby Butzon wrote: > There is indeed a variable called $HTTP_POST_VARS[], but it's no more secure > than just using $fieldname. Added security may come if you changed the > encoding attribute of the form, but I'm not up on that enough to be able to > help there. Correct... what you might want to look into is SSL (secure socket layers), which would send the username and password information to your php-script pre-encoded, preventing "snooping" of the sensitive data. PHP can tell if it is running under SSL by certain system variables, and then go and check the database for correct login... you could even prevent the login form from running unless the login script (where the form resides) is running under SSL. -- Andy Hoffman Web Developer Bristol-Myers Squibb email: andy.hoffman@bms.com