how to call a php function from javascript or if that can't be done, some direction on what I should do

Question

I've created a jquery dialog modal box for logging into my website:

$('#login').dialog({
  modal: true,
  position: 'center',
  autoOpen: false,
  title: 'Login',
  height: '750px',
  width: '300px',
  zIndex: 9999,
  closeOnEscape: false,
  buttons: {
    'Login': function() {
      $(this).dialog('close');
      $('#mask').hide();
      Login();
    },
    'Cancel': function() {
      $(this).dialog('close');
      $('#mask').hide();
    }
  }
});

I've created a php function called Login() in a separate php file, is it possible for me to call that php function when they click on the Login button? If not, how can I get that dialog's Login box to use php to attempt logging in.

gahooa · Accepted Answer · 2010-01-14 01:10:50Z

7

Update: Do this over an SSL connection for true security

You simply need to make a behind-the-scenes request using AJAX. For example, $.post in jQuery.

Click Login
Get username/password from dialog.
$.post() it to the /login.php file that contains the login code
Process this request in PHP.
Output one thing if the login is succesful, or another if it fails.
Recieve this output in the callback function of $.post
Either call window.location = '/nextpage.php' or display an error message.

As per http://docs.jquery.com/Ajax/jQuery.post, you have 4 arguments to $.post:

$.post( url, [data], [callback], [type] )

so that

function onLogin(data)
{
    if(data['success'])
        window.location = 'nextpage.php';
    else
        alert(data['error']);
}

var u = get_username_from_form();
var p = get_password_from_form();

$.post(
   '/login.php', 
   {username: u, password: p}, 
   onLogin, 
   'json' 
)

and in the file login.php, you would:

<?php

$username = (isset($_POST['username']) ? $_POST['username'] : '');
$password = (isset($_POST['password']) ? $_POST['password'] : '');

//Assuming you wrote the authenticate() function
if(authenticate($username, password))
{
   echo json_encode(array('success' => true));
   exit;
}
else
{
   echo json_encode(array('success' => false, 'message' => 'Login Failed!'));
   exit;
}

edited Jan 14, 2010 at 1:10

answered Dec 20, 2009 at 20:15

gahooa

138k14 gold badges101 silver badges104 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Pekka Over a year ago

What an answer! :) This says it all, deleting mine.

gahooa Over a year ago

I should be writing my code for a December 31 deadline, not coding out SO questions, but... lol.

hannebaumsaway Over a year ago

Great info @gahooa, thank you. Could you elaborate a bit on the process for setting u and p in your jquery? Specifically the process for passing the $_POST values from PHP to javascript. Thanks!

Community · Accepted Answer · 2020-06-20 09:12:55Z

0

@gahooa:

this is a great answer! however, you'll definitely want to use an message digest on that password (preferrably with some padding) to make it so that people can't see their username / password clear text.

http://pajhome.org.uk/crypt/md5/scripts.html Here's a great set of JavaScript that will encrypt the information before you send it over the network.

Basically the concept is that you can store the user's password as this encrypted format (also a really good idea) or dynamically compute them if you wish, but after both have been digested they should match.

And then you'd add just 1 function to (gahooa's code):

$.post(
   '/login.php', 
   {username: u, password: hex_md5(p)}, // here
   onLogin, 
   'json' 
);

This is not the most secure that you can be, as you could consider doing a salt as well, where you do this:

var salt = '$@.@^-^$'; // any random value with $p3c14l ch@|2$ (special chars)

$.post(
   '/login.php', 
   {username: u, password: hex_md5(hex_md5(p) + salt)}, // here
   onLogin, 
   'json' 
);

then in the server-side authentication function you'd do a comparison of the hashed values, i.e.:

<?php

    $salt = '$@.@^-^$'; // same as on client-side

    function authenticate( $user, $pass ){
       ...
       if( md5( md5( $storedPassword ) . $salt ) == $_POST['username'] ){ ... }
       ...
    }

?>

or, like I said, you could store the already hashed version

md5( md5( $_POST['signup_password'] ) . $salt )

of users' passwords when they sign up (and convert all existing ones)

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Dec 20, 2009 at 22:08

Dan Beam

3,9462 gold badges25 silver badges29 bronze badges

4 Comments

adhanlon Over a year ago

In the javascript, when I call hex_md5(password), it fails. and doesn't do a POST request. Any idea why?

Dan Beam Over a year ago

you have to download the md5 scrip from the URL I gave you, host it on your site, and include the script on your page with <script url="/wherever/it/is/md5.js"></script>

gahooa Over a year ago

You are effectively making the password a 32 char string. It would be trivial to intercept this (on an open network) and login as the user anytime I want to. This is the kind of problem that SSL was designed to solve.

Dan Beam Over a year ago

yes, SSL is a good solution for encrypting your data, but why not use message digest as well? the reason I hash passwords is to avoid attackers re-using the same credentials on a different site. for instance, if I authenticate to your site and it hashes the password before it is transmitted, tell me the clear text password from this: 2eb60122b172ade05b997a68274236f3. i'll even give you the alg order: md5( '$@.@^-^$' + md5( password ) ). post it here when you crack it, :D

Collectives™ on Stack Overflow

how to call a php function from javascript or if that can't be done, some direction on what I should do

2 Answers 2

3 Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related