Hi,
I have a PHP login scripts that takes the "username" and "password" and stores it in a session.
Once verified as a valid user against a mySQL database, the user is redirected to a members area ( "/secure_area" ), using:
http://username:password@localhost.com/secure_area/This is so that .htaccess (which is in the "/secure_area" folder won't pop up its own "login/password" box).
However, i am having a couple of problems,
first, once the user is redirected to the /secure_area folder, EVERY link on that page (and onwards) is prefixed with
http://username:password@localhost.com...... for everyone to see !!! and thus the password has been exposed. How can I stop it displaying the username and password ?
And also, is this a secure way of logging in?
(it is the only way I can figure out how to do it, so that PHP logs u in and passes username and password to .htaccess quietly).
Many Thanks for any help!
Shams
Start Free Trial
