how to have 1 form field verify another 2

[deecee]

This is for an edit personal info form. I have a password and verify password field. I would like to verify that they both equal each other via php rather than javascript.

How can i have this done and have the same page process it. I might be able to do this over two pages but i dont really know how php_self works. and ive tried it but i cannot figure it out. It seems simple but for some reason im just blocking it out.

thanks in advance

<signature>
sometime you just gotta say &quot;WHAT THE @#*% !!&quot;
</signature>

 

[DRJ478]

PHP is an acronym for pre-hypertext-processor. This means that PHP runs server side and not in the browser. Once your visitor types stuff into the page it has left the server for a long time....
You will need to use JavaScript if you want validation within the browser.

You can use PHP if you post to a PHP script that first evaluates both entries and displayes an error page when they are not identical.

 

[deecee]

thank you -- i guess i will have to use j-script

<signature>
sometime you just gotta say &quot;WHAT THE @#*% !!&quot;
</signature>

 

[csniffer]

i think i should add to this and say that, i hope u aware that if u use javaScript the passwords will be available 4 all to see, as DRJ478 has already said, JS is client side and not server side, hence all code is is veiwable by the client. this is not ideal 4 a password scenario as u can imagine. this could lead to loss of confidence from ur clients (if there are clients involved). good luck with ur site anyway, as u sound like its bin a struggle (arnt they all).

To err is human, to completely mess up takes a computer.

 

[deecee]

dint even think about that..i guess ill just process the form to another page. thanks

<signature>
sometime you just gotta say &quot;WHAT THE @#*% !!&quot;
</signature>

 

[skiflyer]

The password would not need to be available for all to see if you used javascript, no more than they're available for all to see as the page is submitted anyway.

You have two fields on one page, if you want to verify their equivalence -before- they submit the form successfully Javascript is absolutely the right way to do it. If you'd rather do it after they submit and then redraw the form with the correct values already filled in, then PHP is the right choice.

Both are completely acceptable and equally secure if implemented properly, but the javascript solution is circumvented by the user just turning off javascript on their browser.

-Rob

 

[csniffer]

but surly the script can be viewed from view source

To err is human, to completely mess up takes a computer.

 

[skiflyer]

Sure it can, but the script wouldn't contain the password, the script would have something akin to...

pwd = document.form1.password_field;
pwd_verify = document.form1.password_verify;

if (pwd != pwd_verify) {
  alert("Passwords do not match!");
  document.form1.password_field.value = "";
  document.form1.password_verify = "";
  document.form1.password_field.focus = true;
} else {
  document.form1.submit();
}

*Disclaimer, I'm typing that as pseudo-code, I always have to look up syntax when I do javascript.

-Rob

 

[KempCGDR]

I think the confusion here is that csniffer is thinking about a login page, whereas it is actually just a page to edit your info. In the case of a login page, then using javascript would be incredibly dumb as all the passwords would have to be hardcoded into the page. In this case, however, it presumably doesn't need to check as the user should already be logged in, so it should be fine.

 

[csniffer]

yes ur right there KEMPCDJR i apologise i did not read the original ? correctly but even so the way i see it is that the info from the edited form would have to be resubmitted and is therefore viewable by packet sniffing as there is no encryption facilities in JS, but i may be wrong on this. perhaps u could put me right as i am by no means a network or JS guru.

To err is human, to completely mess up takes a computer.

 

[KempCGDR]

However you do it, the form information is being submitted to the server, it has to be for anything to use it. Strangly enough, the exception is javascript, which can intercept the submission and carry out its own processing.

 

[skiflyer]

Yeah, the encryption needs to be done point to point one way or the other, so javascript won't affect the packet sniffing aspect, either that will be set up or it won't.

-Rob