So executing a php script causes the form values to be sent to the server, and then they are processed.

If you want to store a password in your db than you want it to be a cryptographic hash(so your client side is secure, can you generate an md5 using php securely( without submitting the user:password pair in the clear), or is there an alternative standard method of doing this, without having the unecrypted pasword leaving the clients machine?

Sorry if this is a stupid question I'm kind of new at this.

I think this can be done somehow using https, and on that note if a site's login page does not use https, does that mean that while the databse storage is secure, the transportation is not?


The PHP function MD5() is secure. But using MD5() for hashing passwords is not secure. Hackers have created rainbow tables which are MD5 hashes of all passwords up to 12 characters in length. So instead of having to try to "crack" a hash they only need to do a quick SQL query and it's broken.

That's why you should be using stronger hash algorithms like SHA256 or SHA512 with a salt. Or, better yet, use bcrypt which is intentionally slow which makes brute force attempts to break a password impractical.

Or, better yet, use a tried and true solution. Try Openwall's phpass. It's used by Wordpress, Drupal, and more.

FYI, SSL only encrypts the transmission of information over HTTP. It doesn't hash or encrypt anything permanently.

  • Great information, but does the encryption execute client-side (which I know php isn't really designed for), or should I find a javascript alternative? – awiebe Apr 11 '12 at 0:08
  • Don't depend on JavaScript for security. Bypassing it is as easy as turning it off or viewing the source code to see how's it's done. – John Conde Apr 11 '12 at 0:09
  • If the end-user wants to compromise their security, that's not my problem, the problem is packet sniffers, I realize I can't secure against everything but I need a decent hash created client-side, which can be submitted in the clear. – awiebe Apr 11 '12 at 0:11
  • 1
    If you're worried about data transmission being secure, use SSL. If you're worried about storing passwords, use the advice in my answer. FYI, cross-site attacks are your problem, not your users'. – John Conde Apr 11 '12 at 0:12
  • There are many more problems with doing encryption in javascript, the biggest one being that if the page (and the javascript) are not served over SSL, they can be modified by an active MITM attack to either not encrypt at all or to send a copy to a malicious third party. – Ladadadada Jun 1 '12 at 15:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.