Php question. if a user types a username and password in html form. Is it safe to retrieve it via php post?

Question

Will the html form data be sent to php in a secure way or can anyone see the username and password being transmited.

Answer 1

Nope.

Answer 2

The field values are sent in the HTTP header and are handled by your PHP script when they arrive at the server. Unfortunately, they travel across that connection in plain text most of the time.



If you're concerned about the security of the data, you need to use an SSL connection to encrypt the data.



The other option is to do the data verification and encryption on the client (browser) side using Javascript. This isn't a really good option because Javascript isn't not the best language for data verification.

Answer 3

There are two typical requirements for basic security when sending passwords from HTML forms:



1) Use method POST rather than method GET to prevent the name and password from being part of the URL (and appearing in request logs), and



2) Use HTTPS (secure HTTP) rather than plain HTTP so that the form data is encrypted during transmission. Your server must be configured to support this.