Question

i’ve a form in which user can inser a password in a input text field. I want to convert that string in md5 so in post to the action page i will have the md5 version of string and not the string. is possible to change value of input only in post side and not in input text ?

Something like this:

function go(){
   var pass = document.getElementsByName('pass')[0].value;
   pass = md5(pass);
   form.pass.value=pass; 
}

is just a pseudocode. but in this way it will change the text insert by user in the md5 version. i want that user don’t have to see it but in php page in action of form $_POST[‘pass’] will have md5 version of pass. i hope you understood. my english is not very good 😉

SOLUTION :
HTTPS is best solution, but to avoid it is possible to create an input field hidden, fill it with md5 pass and clean the password field 😉

var rp = md5(pass.value);
document.rP.value=rp;
pass.value="";

Answer 1

You are trying to go about this the wrong way.

The best solution is to use HTTPS. This means you don’t have to worry about obfuscating the entered password.

In my solution I accept passwords in plain text over HTTPS and then go one step further by checking their password isn’t one of 12,000 or so ‘simple’ passwords I have stored locally.