I have a form where I have a password field. When the users submits the form, all the fields including the passwords are clearly visible in the url when they passes through the URL to another php page. Is there any way to avoid this ? I dont want the password to be visible.
11267
What's the difference when using GET or POST method? Which one is more secure? What are (dis)advantages of each of them?  ()
32882
I'm designing a microsite that has all the usual functionality. There's a simple registration/login process.   Is it a bad idea to not have a login page and instead just have username and password fields as part of the navigation?
20284
I'm supposed to test a web application for SQL injections. I'm new to this type of security testing and I'd like to get some tips on the matter. Are there any best practices or do I simply search on the Internet for the most common SQL injections and try them out on my application?  I hope some guidance would be profitable for other newbies like me, so please, help me complete the following lists:   List of "places" in the application to be tested:   username  password(s)  e-mail search field  text fields any other fields that are available to the user  List of tests to be performed:   ...?    Thanks!
98276
I'm already using  to store passwords in my database, which means that I should be immune to  attacks. I had a thought, though: what if someone does get hold of my database? It contains the users' email addresses. I can't really hash these, because I'll be using them to send notification emails, etc.. Should I encrypt them?
89001
It's known that when you're connecting to a wrong server via ssh and send your password  to it, your password comes in a plain text and a server saves it by default. Probably. I wonder, where I can retrieve it? I don't see it in /var/log/auth.log, although I do see all the attempts to authenticate.
46215
Is there a way to stop the gmail address field (on the login page) from displaying all the gmail addresses that you have ever typed in it?   When logging in with Google Chrome or trying to set up a new account, anything you type which starts with the same letter as the one that you are trying to use currently will show up in the auto-complete field, I don't want that.    I understand that this is a convenient feature in some cases, but the thing is--I know this shouldn't've happened, but it has actually happened more than once--I sometimes mistyped my password in the Gmail address field right after the address, mistakingly assuming that the prompt had already been moved to the password field, and then hit "Enter" without looking first. The next time I tried to enter my Gmail address, it popped up the address followed by my password as one of the entries on the list of email addresses that shows up, and I couldn't get rid of the entry.   Is there a way to remove these? The autofill feature in Chrome is a time saver, and so I don't really want to turn it off. It would be helpful to be able to edit out some of the typed info, though, so it won't show up again -- is this possible to do?
79209
I know how to delete saved form data in Chrome, but I'd like to be able to see all of the entries stored for fields.   When I type a into a form, I get a list of a few items that I have typed before in that field which begin with a.   I would like to see a complete list, though.
64525
I'd like to do something pretty straightforward: After user fills out a , I'd like a button that simply redirects them to a URL (in this case it's to a demo sandbox). Of course I'd want the user to fill in their info to capture for lead-generation purposes. My  is set up correctly in that it correctly captures all the user fields and submits them to me via email. However, upon completion "click" I'd like to have the user redirected to a determined internal URL www.mysite.com/foo  I can't figure out how this is done with the vanilla webform settings. Am I missing something obvious?
104127
As a response to the recent  and , what is the best way to secure your website against brute force login attacks?  Jeff's post suggests putting in an increasing delay for each attempted login, and a suggestion in the comments is to add a captcha after the 2nd failed attempt.  Both these seem like good ideas, but how do you know what "attempt number" it is?  You can't rely on a session ID (because an attacker could change it each time) or an IP address (better, but vulnerable to botnets).  Simply logging it against the username could, using the delay method, lock out a legitimate user (or at least make the login process very slow for them).  Thoughts? Suggestions?
35326
I am new to PHP. In the path of learning PHP language, I notice that, some website would this kind of URL:  www.website.com/profile.php?user=roa3&amp;...  My questions:   What is the "?" symbol used for?  If I were develop a php website, must I use it in my URL? For example, after a user(roa3) successful logged in, I will redirect to "www.website.com/profile.php?user=roa3" instead of "www.website.com/profile.php" What are the advantages and disadvantages of using it?
113512
Is it legal to have an HTML form with more than one "hidden" control element with the same name? I expect to get the values of all of these elements at the server. If it is legal, do the major browsers implement the behavior correctly?
115983
I want to get user input in one page, store that in a php variable and use it in another php page. I have tried using 'sessions' but it doesn't seem to be working. Is there another safe alternative? This information is likely to be usernames and passwords.
70454
Is it possible for my ISP to see the passwords that I enter on websites and in chat programs? And what about SSL websites that start with https, do they encrypt my username and password before reaching the ISP?
48142
A user may not post a  link if the user doesn't also post some code with it.  I recently learned that .  Why isn't this ban in place with all the other sites similar to JS/PHPFiddle, like , , , ,  etc.?
83827
One of the most common security best practices these days seems to be . I've never really found a good explanation for that, but I'm assuming it's to minimize the risk of a  malicious or infected script within the webroot from reading the database password.  But, you still have to let WordPress access it, so you need to expand open_basedir to include the directory above the document root. Doesn't that just defeat the entire purpose, and also potentially expose server logs, backups, etc to attackers?  Or is the technique only trying to prevent a situation where wp-config.php would be shown as plain-text to anyone requesting http://example.com/wp-config.php, instead of being parsed by the PHP engine? That seems like a very rare occurance, and it wouldn't outweigh the downsides of exposing logs/backups/etc to HTTP requests.  Maybe it's possible to move it outside the document root in some hosting setups without exposing other files, but not in other setups?    Conclusion:  After a lot of back-and-forth on this issue, two answers have emerged that I think should be considered the authoritative ones. Aaron Adams makes a good case in  wp-config, and chrisguitarguymakes a good . Those are the two answers you should read if you're new to the thread and don't want to read the entire thing. The other answers are either redundant or inaccurate.
37436
I'm using  to check if a user-provided email address is valid. For example:  $email = $_POST['email']; if ( is_email( $email ) )     // Do something.   To the best of my knowledge, nothing in this function writes info to the database. Should I be sanitizing $email before I pass it to the function?
122510
I have found a  very similar to this, which I thought would solve my problem.   However, after changing my .htaccess file, with index.php on the end of the list, and then index.php as the only entry, I still cannot get index.php to display.  Every other page works fine, but I don't know how to fix this.  Thanks.