Re: Sequrity without HTTPS?

fabien champel <stooligraphes@xxxxxxxxx> · Fri, 19 Nov 2004 22:43:24 +0100



you can fint sha1 and md5 functions in javascript here :
http://pajhome.org.uk/crypt/md5/index.html

______________________________

example :

before <html>
<?php
session_start();
if ( function_exists("session_regenerate_id") ) session_regenerate_id();

$l = &$_POST["login"];
$p = &$_POST["pass"];
$lemd5 = md5("1234".$_SESSION["str"]);

if ( isset($l) && $l=="login" && isset($p) && $p == $lemd5 ){
	$logged = true;
	unset($_SESSION["str"]);
} else {
	srand(time());
	$myStr = sha1( rand() );
	$_SESSION["str"] = $myStr;
	$logged = false;
}
?>


in head :
<?php  if ( !$logged ) { ?>
<script type="text/javascript" src="md5.js"></script>
<script type="text/javascript">

function goForm(){
	val = document.formul.pass.value;
	md5 = hex_md5(val+"<?php echo $myStr; ?>");
	document.formul.pass.value = md5;
	document.formul.action = "index.php";
	document.formul.submit();
}

</script>
<?php } ?>


and in body
<?php  if ( !$logged ) { ?>

<form method="POST" action="javascript:goForm()" name="formul">
<input type="text" name="login" id="login" /><br />
<input type="password" name="pass" id="pass" /><br />
<input type="submit" value="envoyer" />

</form>
<?php } else { ?>
ok ;)
<?php } ?>


i hope that it can be useful :-)

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php