Webmaster Forum / HTML, CSS, Scripts / JavaScript / December 2006

Anthony wrote on 30 dec 2006 in comp.lang.javascript:

Sending the usernames and passwords to anyone on the web
is not realy a secure constraint.
I think it is more dangerous thad having no login at all,
because it gives false security to the user [and webmaster!]

Prossessing an xml file for display is another ball game,
where others might help you better.

If the requested file is saved on a server, you could just put in the URL
and have the user download the file.

If it is saved on the client's pc, there is no access without
compromizing the security settings of the individual browser.

But again, please do not use the above fake security
of using clientside password checking!!!

That being said,
the above code is a bit strange,
as if the programmer did not know the "else" clause.

Where more users should be added a loop and array is more versatile,
only safe to use in a protected intra(!)net surrounding:

=============== test.html ==================
<script type='text/javascript'>
function Login(f){

 var username = f.elements['username'].value.toLowerCase();
 var password = f.elements['password'].value.toLowerCase();
 var arr = [
     ['member1','password1','http://x.yz/page1.html'],
     ['member2','password2','http://x.yz/page2.html'],
     ['member3','password3','http://x.yz/page3.html']
   ];

 for (n=0;n<arr.length;n++)
   if (username == arr[n][0] && password == arr[n][1]) {
     window.location.href = arr[n][2];
     return false;
   };

 alert('Invalid login!');
 return false;

};
</script>

<form name='login' onsubmit='return Login(this)'>
<input name='username'> username<br>
<input name='password'> password<br>
<input type='submit' value='go'>
</form>
==========================================