ansaurus

Question

validating input type="password" created in php?

Answer 1

+1 A:

Don't do it. It's dangerous to put sensible data into HTML code, where it is cached and whatnot.

It's probably not possible to access a password field's value anyway (I have never tried it). And if it is, you can't rely on it.

If you need to keep form values until some steps have been completed, store them in a PHP Session.

Basic info on session handling: http://www.php.net/manual/en/book.session.php

Pekka 2009-11-16 14:21:37

read update plz

Camran 2009-11-16 14:22:53

I don't understand what you're doing, in the end there is only one form, not a PHP and HTML part. Can you explain in more detail?

Pekka 2009-11-16 14:23:43

@camran, the value of the password field is already being submit when the users submits the form; or at least should be...

matt b 2009-11-16 14:27:38

Answer 2

+4 A:

you really really should not do that, putting it in the hidden input field makes it freely readable for everyone that can open the page, even if your session would time out the password would still be retreivable in the page's source. scenario: user presses logout, next user comes along, presses back, view source and tada password for grabs

Peter 2009-11-16 14:21:51

True, but if the php page is just reading the post, the post may not be saved in the history. The issue is that it should be hashed to safeguard it.

Cryophallion 2009-11-16 15:14:09

Answer 3

A:

Maybe I don't fully understand, but hidden fields within a form are not really hidden... they are still visible with a "view source". Do not place your clear text passwords in your HTML.

Are your passwords stored in an encrypted format? If so, encrypting your password and placing it in your hidden field in that manner may be acceptable if your workflow absolutely requires it.

Wes 2009-11-16 14:24:11

Answer 4

A:

Hash it.

At the top of the page, you parse all the $_POST values. when you are parsing the password value, convert it to a hash (sha1, or better ones with hash).

This should be what is stored in the db anyway (or else anyone with db access could read the plain text passwords).

This can be safely stored in the hidden field on the page, and just use stars or circles to show that a password was selected.

BTW, I recommend Lynda's php essential training. They have a good video just on dealing with this.

Cryophallion 2009-11-16 15:09:49

ansaurus

tags:

views:

answers:

validating input type="password" created in php?

related questions