Question

how can i implement a secure transfer from login form on client to server in php?
i mean coding password and user ,something except using https.

Answer 1

HTTP Digest authentication can work without requiring SSL.

But it has the same problems as other HTTP authentication. E.g. there’s no logout function, you can’t control the look & feel of the login UI, no integration between login credentials and your application-specific user account data, etc.

I agree with @Charles — just use HTTPS when sending sensitive data.

---

Re your comment:

At the start of your login.php script, check if the request is https and if not then redirect to the correct url.

if (!isset($_SERVER["HTTPS"])) {
  header("Location: https://mydomain.com/login.php");
}

Alternatively you could use an Apache rewrite rule:

RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^/(login.php) https://%{SERVER_NAME}/$1 [L,R]

Also, remember that you don’t care if the client read the page with the login form with plain http. You care if the client submits the form insecurely, because that’s the request that contains the user’s password. So the above advice applies if login.php is the script that processes the login form.