PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Encryption Basics
351
Passwords can also be captured electronically. By running a program to capture
keystrokes at a terminal or using a packet sniffer to capture network traffic, crackers
can—and do—capture usable pairs of login names and passwords.You can limit the
opportunities to capture passwords by encrypting network traffic.
For all their potential flaws, passwords are a simple and relatively effective way of
authenticating your users.They provide a level of secrecy that might not be appropriate
for national security but is ideal for checking on the delivery status of a customer’s order.
Authentication mechanisms are built in to the most popular web browsers and web
servers. A web server might require a username and password for people requesting files
from particular directories on the server.
When challenged for a login name and password, your browser presents a dialog box
similar to the one shown in Figure 15.2.
Figure 15.2 Web browsers prompt users for authentication when they
attempt to visit a restricted directory on a web server.
Both the Apache web server and Microsoft’s IIS enable you to very easily protect all or
part of a site in this way. Using PHP or MySQL, you can achieve the same effect. Using
MySQL is faster than the built-in authentication. Using PHP, you can provide more
flexible authentication or present the request in a more attractive way.
We look at some authentication examples in Chapter 17,“Implementing Authentication
with PHP and MySQL.”
Encryption Basics
An encryption algorithm is a mathematical process to transform information into a seemingly
random string of data.
The data that you start with is often called plain text, although it is not important to
the process what the information represents—whether it is actually text or some other
sort of data. Similarly, the encrypted information is called ciphertext but rarely looks anything
like text. Figure 15.3 shows the encryption process as a simple flowchart.The plain
text is fed to an encryption engine, which might have been a mechanical device, such as