I am very interested to find out how to keep php passwords secure.
Main question is: How do I post the password as a secured string from the login form?
I have been checking how other sites do this e.g. facebook. When I log in to facebook I dont see my password posted at all, it just seems like a long encrypted string.
How do I convert the password field to an encrypted string before posting? Is this done with ajax?
Cheers
Ke
Check the HTTPS protocol
If you cannot enable HTTPS for your site and don’t want to post cleartext passwords (for obvious security reasons), consider using Challenge-Response Authentication.
Just google for various PHP/Javascript implementations and pick one you like.