when using an html form and submitting this form to another php file. When should I encrypt important data like passwords ? Where should I encrypt them.

1 Answer 1


Q: When should I encrypt passwords?
A: Always, and as soon as possible.

Whenever a user enters sensitive information like a password, you should immediately encrypt it using a one-way hash function before you do anything at all with it. You should never store a plaintext password in a database, pass it from one PHP file to another, print it, or even store it temporarily in a variable (except to the extent that this is unavoidable, as when you access a user's input from the $_POST super-global variable).

As far as what you should be doing with a hashed password, this is basically limited to storing the hashed password in a database table for later validation. You should never pass a hashed password from one PHP file to another (i.e., from a Controller to a View), and you should never print it or otherwise expose it to public scrutiny.

If you are working on Problem Set 7 (C$50 Finance), then the source code provided for login.php should provide an excellent example of how to validate a hashed password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .