Reading session variables with javascript?

[craigey]

Is it possible to read a session variable using javascript?

I'm trying to use an image verification script using PHP. I need to check the MD5 hash of the value entered into the text box is equal to the MD5 hash of the Imagecode.

The imagecode is stored as a session variable

$_SESSION['image_random_value'] = md5($rand);

In my javascript verficaton I want to check if the MD5 hash is corrct, but don't know where to start.

If javascript isn't able to access the variable is there another way of storing the md5 hash securely & matching from that?

 

[craigey]

Ok, just found another thread 2 posts below this one asking something fairly similar.

So far I've got:

			if (f.value=='<%=session("image_random_value")%>'){
			return true
			}else{
			return false

 

[craigey]

I think I've got it. But there's a different issue now. The session var contains the previous image code.

I'm guessing this is because the form is being posted to somewhere other then itself. Or maybe it's got something to do with the javascript validation....

Any ideas???

 

[BillyRayPreachersSon]

Why not do the test server-side in PHP?

That would make more sense than anything client-side, and would certainly be a lot more secure, too.

Dan



[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[BillyRayPreachersSon]

In fact, I've never, ever, seen one of these image verification scripts checked client-side (assuming you're talking about a captcha-type image).

Really - I can't advise strongly enough the values of doing this server-side. You have PHP available to you, you have the hash available to you, and you have the user's input available to you. Surely it's a no-brainer?

Dan



[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[craigey]

The reason i'm trying to check it from the clientside is that the I already have a javascript verification to see if the other fields are empty / or in the correct format (for e-mail address).

Although I'd be happy to check the session var in php, I'd still like the javascript to warn the user that the field is incorrect. Currently it only shows an image if the code field is empty.


Take a look here to see what I mean:

http://www.cw-product.co.uk/test.html

 

[BillyRayPreachersSon]

What you'd need to do would be to have an MD5 encoding script client-side, run the user's input through it, and then compare that with your server-delivered code.

I've not looked, but I'm sure these are freely available.

Hope this helps,
Dan



[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[craigey]

thanks. I'm going to try redesigning the page & see what happens from there.