I am new to website security and I need to make a registration and login system. I am not yet using https for it, how can I make my registration secure?
This is my registration form, index.php, I use ajax to pass the form values to create_account.php .
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.5.2/jquery.min.js"></script>
<script type="text/javascript" language="javascript">
function submitForm() {
$.ajax({type:'POST', url: 'create_account.php', data:$('#ContactForm').serialize(), success: function(response) {
$('#ContactForm').find('.form_result').html(response);
}});
return false;
}
</script>
<form id="ContactForm" onsubmit="return submitForm();" method="POST">
<input type="text" name="fname" value=""/>
<input type="text" name="lname" value="" />
<input type="text" name="email" value="" />
<input type="text" name="vEmail" value="" />
<input type="password" name="password" value="" />
<input type="password" name="vPassword" value="" />
<input type="submit" name="submit" value="Submit" onclick="password.value=sha256_hash(password.value)"/>
<div class="form_result">
I tried onclick="password.value=sha256_hash(password.value)" but it doesn't work at all. Now I am unsure about how an attacker can get the information sent from index.php to create_account.php. Is it possible to hash (sha256/512) and salt it with javascript? In create_account.php, I am already doing this type of security.
If it is not possible, how can we set https (I know almost nothing about ssl)?