Solved

Secure forms

Posted on 2006-07-17
3
182 Views
Last Modified: 2006-11-18
I am working toward securing personal health information submitted by users in a form and processed by a PHP script which mails it directly to my web site customer (doctor) as an email.  There will be no storage of this info on the server.  I am working on SSL from the server to my doc's office but am concerned that if using the https:// route for client to server will be sufficient to prevent info theft.  I understand that packets are routed differently, rendering sniffer useless enroute and if the remote server is compromised they would have root and it would be moot (whoops, accidental poetry). So the only route I am in question about is from the user to the server. But any alternatives or known problems would be helpful.   Thanks.
0
Comment
Question by:insouciant
  • 2
3 Comments
 
LVL 7

Accepted Solution

by:
maUru earned 125 total points
ID: 17123478
https:// is more than enough for client to server encryption

if it wasnt then online banking systems would all go bankrupt

you cannot really encode it yourself as http is a plain text protocol, using ssl, you get 128 bits of encryption, which would roughly take by todays standards 1 million years to crack

which is long enough....i think
0
 
LVL 7

Expert Comment

by:maUru
ID: 17123513
of course there are other factors that you must take care of:

1. making sure the 'back' button doesnt return to the form and causing the browser to autofill the previous fields
2. make sure no sessions are used that can be duped by a knowledgable hacker
3. using ssl /before/ a login script is used
4. make sure secure passwords are used, minimum 8 characters, include a number or two and some capitals and an asterix....the weakest link in security is usually the users themselves.
0
 

Author Comment

by:insouciant
ID: 17129622
Thanks for the very complete answer maUru.
0

Featured Post

Courses: Start Training Online With Pros, Today

Brush up on the basics or master the advanced techniques required to earn essential industry certifications, with Courses. Enroll in a course and start learning today. Training topics range from Android App Dev to the Xen Virtualization Platform.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
.htaccess 5 33
PHP: Insert Data into MySQL 5 39
Why do people dis php? 5 45
000webhost.com default error log 1 24
Things That Drive Us Nuts Have you noticed the use of the reCaptcha feature at EE and other web sites?  It wants you to read and retype something that looks like this.Insanity!  It's not EE's fault - that's just the way reCaptcha works.  But it is …
Nothing in an HTTP request can be trusted, including HTTP headers and form data.  A form token is a tool that can be used to guard against request forgeries (CSRF).  This article shows an improved approach to form tokens, making it more difficult to…
Learn how to match and substitute tagged data using PHP regular expressions. Demonstrated on Windows 7, but also applies to other operating systems. Demonstrated technique applies to PHP (all versions) and Firefox, but very similar techniques will w…
The viewer will learn how to dynamically set the form action using jQuery.

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now