Connecting Tech Pros Worldwide Help | Site Map

input type=password question

 
LinkBack Thread Tools Search this Thread
  #1  
Old November 11th, 2005, 02:45 PM
Greg Scharlemann
Guest
 
Posts: n/a
Default input type=password question

I've got a simple registration script that has an input field of type
password. When I retrieve what is typed in the password field via:

$_REQUEST["password"];

I always get the same encoded string: 8f404d5399b6eb816fe579381a0e2e6c

First, does PHP automatically encrypt the password type fields and if
so what method does it use and can I disable it?

and second, is that the correct way to get the password from a simple
form or is there a better way of doing it?

Thanks, Greg


  #2  
Old November 11th, 2005, 02:55 PM
David Gillen
Guest
 
Posts: n/a
Default Re: input type=password question

An noise sounding like Greg Scharlemann said:[color=blue]
> I've got a simple registration script that has an input field of type
> password. When I retrieve what is typed in the password field via:
>
> $_REQUEST["password"];
>
> I always get the same encoded string: 8f404d5399b6eb816fe579381a0e2e6c
>[/color]
You should be getting a plain text string of whatever the user typed in. It is
up to you then to encode/encrypt that some way when storing it.

[color=blue]
> and second, is that the correct way to get the password from a simple
> form or is there a better way of doing it?
>[/color]
$_REQUEST is fine. Although if your form is using method="POST" you might
consider using $_POST instead.

db
--

/(bb|[^b]{2})/
Trees with square roots don't have very natural logs.

  #3  
Old November 11th, 2005, 02:55 PM
Peter van Schie
Guest
 
Posts: n/a
Default Re: input type=password question

Greg Scharlemann wrote:[color=blue]
>
> I always get the same encoded string: 8f404d5399b6eb816fe579381a0e2e6c[/color]

Looks like an md5 hash.
[color=blue]
> First, does PHP automatically encrypt the password type fields[/color]

No.
[color=blue]
> and second, is that the correct way to get the password from a simple
> form or is there a better way of doing it?[/color]

The method is fine, but I can't tell why you get an md5 hash instead of
the plain password that was specified.

HTH.
Peter.
--
http://www.phpforums.nl
  #4  
Old November 11th, 2005, 03:05 PM
Kim André Akerĝ
Guest
 
Posts: n/a
Default Re: input type=password question

Greg Scharlemann wrote:
[color=blue]
> I've got a simple registration script that has an input field of type
> password. When I retrieve what is typed in the password field via:
>
> $_REQUEST["password"];
>
> I always get the same encoded string: 8f404d5399b6eb816fe579381a0e2e6c
>
> First, does PHP automatically encrypt the password type fields and if
> so what method does it use and can I disable it?
>
> and second, is that the correct way to get the password from a simple
> form or is there a better way of doing it?[/color]

The password field isn't encrypted by the client before being sent to
the server, it's just a method of hiding what is typed to other people
who may also be watching the same screen as the person who's typing it
in.

What happens if you output the following variables?
$_GET["password"]
$_POST["password"]
$_COOKIE["password"]

--
Kim André Akerĝ
- kimandre@NOSPAMbetadome.com
(remove NOSPAM to contact me directly)
  #5  
Old November 11th, 2005, 03:15 PM
Greg Scharlemann
Guest
 
Posts: n/a
Default Re: input type=password question

Peter van Schie wrote:[color=blue]
> Greg Scharlemann wrote:[color=green]
> >
> > I always get the same encoded string: 8f404d5399b6eb816fe579381a0e2e6c[/color]
>
> Looks like an md5 hash.
>[color=green]
> > First, does PHP automatically encrypt the password type fields[/color]
>
> No.
>[/color]

Could this be a setting on the server perhaps?

Here's a simple script that I tried and it still encrypts the password
everytime to the same string: you can try it here:
http://devel.dailyunrest.com/test.php
--------------------------------------------------------
<?php

$register = $_REQUEST['Register'];

$valid = false;
if($register == "Register") {
$password = $_REQUEST['password'];
print $password;
}
?>
<html>
<body>
<form action="test.php" method="post">
<table width="50%" cellspacing="1" cellpadding="1" border="0">
<tr>
<td><b>Password:</b></td>
<td><input type="password" name="password" size="35"></td>
</tr>
<tr>
<td><b>Confirm Password:</b></td>
<td><input type="password" name="confirmPassword" size="35"></td>
</tr>
<tr>
<td>&nbsp;</td>
<td><input type="submit" name="Register" value="Register" /></td>
</table>
</form>
</body>
</html>
-----------------------------------------------------

  #6  
Old November 11th, 2005, 03:15 PM
Greg Scharlemann
Guest
 
Posts: n/a
Default Re: input type=password question

>[color=blue]
> What happens if you output the following variables?
> $_GET["password"]
> $_POST["password"]
> $_COOKIE["password"]
>[/color]

Looks like it's from a cookie... if I'm not using cookie's how does
that work?

  #7  
Old November 11th, 2005, 03:15 PM
Oli Filth
Guest
 
Posts: n/a
Default Re: input type=password question

Greg Scharlemann said the following on 11/11/2005 16:01:[color=blue]
> Peter van Schie wrote:
>[color=green]
>>Greg Scharlemann wrote:
>>[color=darkred]
>>>I always get the same encoded string: 8f404d5399b6eb816fe579381a0e2e6c[/color]
>>
>>Looks like an md5 hash.
>>
>>[color=darkred]
>>>First, does PHP automatically encrypt the password type fields[/color]
>>
>>No.[/color]
>
> Could this be a setting on the server perhaps?
>
> Here's a simple script that I tried and it still encrypts the password
> everytime to the same string: you can try it here:
> http://devel.dailyunrest.com/test.php[/color]

It worked fine when I tried it...

--
Oli
  #8  
Old November 11th, 2005, 03:15 PM
Oli Filth
Guest
 
Posts: n/a
Default Re: input type=password question

Greg Scharlemann said the following on 11/11/2005 16:05:[color=blue][color=green]
>>What happens if you output the following variables?
>>$_GET["password"]
>>$_POST["password"]
>>$_COOKIE["password"]
>>[/color]
>
>
> Looks like it's from a cookie... if I'm not using cookie's how does
> that work?
>[/color]

I bet you have a cookie called "password" set in your browser for this
domain. Check it in your browser and see.

By default, in $_REQUEST, cookie variables override POST variables,
which override GET variables.

For this reason, it's generally safer to use $_GET, $_POST and $_COOKIE
explicitly.

--
Oli
  #9  
Old November 11th, 2005, 03:25 PM
Greg Scharlemann
Guest
 
Posts: n/a
Default Re: input type=password question

Sweet. Thanks all for your help, now on to the next thing...

Greg

 

Bookmarks

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

Popular Articles

What is Bytes?

We are a network of experts and professionals in IT and software development that help one another with answers to tough questions and share insights. Get the best answers to your questions from over 220,989 network members.