[SOLVED] Encrypt password between pages.

[lynxus]

Hi guys,

I have i hope to be a simple question.

 

I have some ajax that passes a password to the php file it gets its data from, However this i know is completely bad.

Im trying to figure out how to do it properly.

 

I cant use $_SESSION for some reason. the page the ajax reads doesnt seem to be able to get the session data.

 

What would be good is if i could do something like this:

 

Mainpage -> ajax request data.php ( that then populates something on mainpage. )

 

Mainpage:

$password = $_POST['password'];

$_SESSION['password'] = Encrypted version of password .

 

data.php

 

$encpass = $_GET['password'];

$password = unencrypt $encpass.

 

What im trying to achieve is being able to pass an encrypted pass between pages and then have the pages unencrypt in the code itself..

 

am i doing this wrong?

any ideas how to achieve this?

 

Thanks

G

[Jibberish]

First things first, are you calling session_start() ?

And to get the password on the second page you need to do

 

$encpass = $_SESSION['password'];

[lynxus]

Yeah, session works fine on the main page.

 

I can put something in session and yeah its called at the start.

 

Currently im just passing the password in a get request from ajax.

 

I need to figure out how to

do summat like

$password = encrypt it $_SESSION['password'];

 

This way when i send $password its encrypted.

 

on the other script

 

it would read the value of password via a get.

 

Then on the other script id like it to do.

 

$ecrpass = $_GET['password'];

 

$password = unencrypt $ecrpass;

 

now $password would be the original pass.

[lynxus]

I think what im asking really is..

How do i do this:

 

I have a var

$password = "imapassword";

 

I want to encrypt this.

 

Encrypt $password;

 

Then in another page after ive sent the encrypted pass.

 

i want to

$password = unencrypt $_GET['password'];

 

So i suppose basically.

I want to be able to encrypt $password and then decrypt it ( in the simplest way , Im not uber at php )

 

 

[JonnoTheDev]

You never decrypt passwords. You get the password from the username via the db and then encrypt it. If it matches the value you have used to test then it is correct.

 

i.e.

1. send username and encrypted password to server

2. get password record from db using username

3. encrypt password

4. do values match

[lynxus]

Cool,

Ive managed to sort this.

 

Before it was showing the password in the source!! baaaad.

Now its encrypted and stored in session.

 

_g