Solved

Secure forms

Posted on 2006-07-17
3
180 Views
Last Modified: 2006-11-18
I am working toward securing personal health information submitted by users in a form and processed by a PHP script which mails it directly to my web site customer (doctor) as an email.  There will be no storage of this info on the server.  I am working on SSL from the server to my doc's office but am concerned that if using the https:// route for client to server will be sufficient to prevent info theft.  I understand that packets are routed differently, rendering sniffer useless enroute and if the remote server is compromised they would have root and it would be moot (whoops, accidental poetry). So the only route I am in question about is from the user to the server. But any alternatives or known problems would be helpful.   Thanks.
0
Comment
Question by:insouciant
  • 2
3 Comments
 
LVL 7

Accepted Solution

by:
maUru earned 125 total points
Comment Utility
https:// is more than enough for client to server encryption

if it wasnt then online banking systems would all go bankrupt

you cannot really encode it yourself as http is a plain text protocol, using ssl, you get 128 bits of encryption, which would roughly take by todays standards 1 million years to crack

which is long enough....i think
0
 
LVL 7

Expert Comment

by:maUru
Comment Utility
of course there are other factors that you must take care of:

1. making sure the 'back' button doesnt return to the form and causing the browser to autofill the previous fields
2. make sure no sessions are used that can be duped by a knowledgable hacker
3. using ssl /before/ a login script is used
4. make sure secure passwords are used, minimum 8 characters, include a number or two and some capitals and an asterix....the weakest link in security is usually the users themselves.
0
 

Author Comment

by:insouciant
Comment Utility
Thanks for the very complete answer maUru.
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Suggested Solutions

These days socially coordinated efforts have turned into a critical requirement for enterprises.
Since pre-biblical times, humans have sought ways to keep secrets, and share the secrets selectively.  This article explores the ways PHP can be used to hide and encrypt information.
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
The viewer will learn how to count occurrences of each item in an array.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now