when using an html form and submitting this form to another php file. When should I encrypt important data like passwords ? Where should I encrypt them.
1 Answer
Q: When should I encrypt passwords?
A: Always, and as soon as possible.
Whenever a user enters sensitive information like a password, you should immediately encrypt it using a one-way hash function before you do anything at all with it. You should never store a plaintext password in a database, pass it from one PHP file to another, print it, or even store it temporarily in a variable (except to the extent that this is unavoidable, as when you access a user's input from the $_POST super-global variable).
As far as what you should be doing with a hashed password, this is basically limited to storing the hashed password in a database table for later validation. You should never pass a hashed password from one PHP file to another (i.e., from a Controller to a View), and you should never print it or otherwise expose it to public scrutiny.
If you are working on Problem Set 7 (C$50 Finance), then the source code provided for login.php should provide an excellent example of how to validate a hashed password.
answered Sep 9, 2016 at 14:53
