Tell me more ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.
up vote -2 down vote favorite

How could I input php in this so when it has a correct password it stores the information as a cookie and then allow the deletion to it too.

  <SCRIPT language="JavaScript">
    <!--hide

    var password;

    var pass1="password";

    password=prompt('Please enter your password to view this page!',' ');

    if (password==pass1){
      alert('Password Correct! Click OK to enter!');}
    else
       {
        window.location="//Some Location//";
        }

    //-->
    </SCRIPT>
share|improve this question
3  
You don't need PHP do create a cookie, you can do that from JavaScript. But you do need PHP for authentication. Use JavaScript like that, and your site will be hacked by a 5-year old kid in seconds. – bfavaretto May 10 '12 at 1:38
@bfavaretto 4 year old. I know some smart kids. – iambriansreed May 10 '12 at 1:39
Agreed. Worst security ever. – Chris May 10 '12 at 1:39
@jeroen, I hope my answer is constructive enough – Starx May 10 '12 at 1:45
@Starx It is, and where the research effort is concerned I guess the downvotes are justified as well... – jeroen May 10 '12 at 1:57

2 Answers

up vote 1 down vote accepted

If its simple enough (As per the title)

var varname = '<?php echo $_SESSION["variable_name"]; ?>';

But you have to seriously consider your logic. You are checking for authentication on javascript, which is going to be dumbest move in a web application.

The password is totally exposed, and any one can view them or turn off the javascript as a whole, then your whole site becomes vulnerable.

My suggestion is an AJAX request to a PHP page which separately checks and verifies the password and then returns message to the Javascript.

share|improve this answer
how would i put it though so its $_SESSION["variable_name"] == pass1 – user1345650 May 10 '12 at 1:39
@user1345650, You cannot do like that, php runs on server and javascript on client's machine – Starx May 10 '12 at 1:40
up vote 1 down vote

This is completely wrong:

  • You will have password displayed in the source code of the page and in the history of the browser for anybody to see. So even if they don't have the password, they can just check the source-code to get it.
  • You need to protect the current page server-side as anybody that disables javascript can open it now. An easy way to do that, would be to handle the login server-side and set a certain session variable for a successfully logged-in user. You can then check at the top of your page if that session variable is set.
share|improve this answer
//Some location// seems to be the "access denied" page, not the final destination (which I'm assuming is the current page, accessible by just disabling JavaScript). – bfavaretto May 10 '12 at 1:47
@bfavaretto You're right, I didn't read it correctly. I'll adapt my answer.... – jeroen May 10 '12 at 1:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.