?
Solved

Secure forms

Posted on 2006-07-17
3
Medium Priority
?
193 Views
Last Modified: 2006-11-18
I am working toward securing personal health information submitted by users in a form and processed by a PHP script which mails it directly to my web site customer (doctor) as an email.  There will be no storage of this info on the server.  I am working on SSL from the server to my doc's office but am concerned that if using the https:// route for client to server will be sufficient to prevent info theft.  I understand that packets are routed differently, rendering sniffer useless enroute and if the remote server is compromised they would have root and it would be moot (whoops, accidental poetry). So the only route I am in question about is from the user to the server. But any alternatives or known problems would be helpful.   Thanks.
0
Comment
Question by:insouciant
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 7

Accepted Solution

by:
maUru earned 500 total points
ID: 17123478
https:// is more than enough for client to server encryption

if it wasnt then online banking systems would all go bankrupt

you cannot really encode it yourself as http is a plain text protocol, using ssl, you get 128 bits of encryption, which would roughly take by todays standards 1 million years to crack

which is long enough....i think
0
 
LVL 7

Expert Comment

by:maUru
ID: 17123513
of course there are other factors that you must take care of:

1. making sure the 'back' button doesnt return to the form and causing the browser to autofill the previous fields
2. make sure no sessions are used that can be duped by a knowledgable hacker
3. using ssl /before/ a login script is used
4. make sure secure passwords are used, minimum 8 characters, include a number or two and some capitals and an asterix....the weakest link in security is usually the users themselves.
0
 

Author Comment

by:insouciant
ID: 17129622
Thanks for the very complete answer maUru.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo‚Ķ
This article discusses how to implement server side field validation and display customized error messages to the client.
The viewer will learn how to dynamically set the form action using jQuery.
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question