How secure is this script?

[thehittmann1981]

[HTML]<tr><td colspan=2 align=center><font size="+2"><b>Members-Only Area!</b></font></td></tr>
<tr><td>Username:</td><td><select name=memlist>
<option value='x'>
<option value='John Smith|42691|NGLOQEMM'>John Smith
<option value='Peter Jones|52219|GNLVAPMV'>Peter Jones
<option value='Sue Brown|18215|PXAPGWKY'>Sue Brown
<option value='Sally West|64403|NUIRTURT'>Sally West
</select></td></tr>
<tr><td>Password:</td><td><input type=password size=10 maxlength=8 name=pass></td></tr>
<tr><td colspan=2 align=center><input type=button value="Login" onclick="check(this.form)"></td>
</tr>
</table>
</form>
[/HTML]

<SCRIPT LANGUAGE="JavaScript">
<!-- Begin
var params=new Array(4);
var alpha="ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHI";
function check(form) {
which=form.memlist.selectedIndex;
choice = form.memlist.options[which].value+"|";
if (choice=="x|") {
alert("Please Select Your Name From The List");
return;
}
p=0;
for (i=0;i<3;i++) {
a=choice.indexOf("|",p);
params[i]=choice.substring(a,p);
p=a+1;
}
h1=makehash(form.pass.value,3);
h2=makehash(form.pass.value,10)+" ";
if (h1!=params[1]) {
alert("Incorrect Password!"); return; };
var page="";
for (var i=0;i<8;i++) {
letter=params[2].substring(i,i+1)
ul=letter.toUpperCase();
a=alpha.indexOf(ul,0);
a-=(h2.substring(i,i+1)*1);
if (a<0) a+=26;
page+=alpha.substring(a,a+1); };
top.location=page.toLowerCase()+".html";
}
function makehash(pw,mult) {
pass=pw.toUpperCase();
hash=0;
for (i=0;i<8;i++) {
letter=pass.substring(i,i+1);
c=alpha.indexOf(letter,0)+1;
hash=hash*mult+c;
}
return(hash);
}
// End -->
</script>

[dmjpro]

Hey!
Welcome to TSDN!
Be specific and use Code Tags while you do Post.
Be more specific about your Problem.

Kind regards,
Dmjpro.

[thehittmann1981]

im not too sure what you mean by "code tags" i thought they were already included in what i posted.

I got the code from another javascript site and basically what it does is encrypt pasword | page.html for each user you choose. Users can be directed to the same page or each to a different page as you choose. What i dont know seeing that i pretty much know nothing about javascript is how easy this is to decode.

[gits]

hi ...

code tags are wrapped around your posted code to format and syntax-highlight it:

for example:

[CODE=javascript]
code goes here
[/code]

kind regards

[acoder]

I got the code from another javascript site and basically what it does is encrypt pasword | page.html for each user you choose. Users can be directed to the same page or each to a different page as you choose. What i dont know seeing that i pretty much know nothing about javascript is how easy this is to decode.

Anything on the client-side is relatively easy to decode especially for someone determined.

In your code, someone just needs to reverse the process of makehash() and they have the required passwords and URLs.

The solution is to code all login on the server-side.