Question

I always used plain HTML version for login but wish to start using jQuery version from now on. Is there any advantages or disadvantages one over another? Security point of view please.

Note: I’ll validate variable back end so no worries about it for now.

Thanks

Plain HTML

<form name="login" method="post" action="login.php">
    Username: <input type="text" id="username" name="username" /><br />
    Password: <input type="password" id="password" name="password" /><br />
    <input type="submit" id="submit" name="submit" value="Login" />

    <input type="hidden" id="hash" name="hash" value="dynamic has goes here" />
    <input type="hidden" id="trap" name="trap" value="allways empty" />
</form>

JQuery style

$(document).ready(function()
{
    $("#login").submit(function(event)
    {
        event.preventDefault();

        var username = $('#username').val();
        var password = $('#password').val();
        var hash = $('#hash').val();
        var trap = $('#trap').val();

        $.ajax({
            type        : 'POST',
            url         : 'login.php',
            data        : {username:username, password:password, hash:hash, trap:trap},
            dataType    : 'json',
            cache       : false,
            success     : function(response)
            {
                window.location = response.redirect;
            },  
            error       : function(response)
            {
                //Process
            }
        });

        return false;
    });
});

<form name="login" method="post">
    Username: <input type="text" id="username" name="username" /><br />
    Password: <input type="password" id="password" name="password" /><br />
    <button type="submit">Login</button>

    <input type="hidden" id="hash" name="hash" value="dynamic has goes here" />
    <input type="hidden" id="trap" name="trap" value="allways empty" />
</form>

Answer 1

From a security point of view, if you click on a submit button of a “post” form, you browser will perform a post request to the server.
If you use jQuery, the post request will be exactly the same.

My only recommendation is to use https.