Getting the server to pass variables and not the client browser

[computermonkey]

Hi

I have a page on my site that has a form for people to include their name and e-mail that I need to send to another site to save to a database.

The receiving/action page will then give a response depending on the point of failure or if the send and storage was successful.

Seems simple enough, but I need to include a use an id and password with the information for the third party to accept the info.

I can't include these as hidden form fields, as you could see them in the source.

I can post the inputted variables to a second page and add the sensitive variables before using the header function in php to call up the third party site, but I can only use query string from there to pass the variables over, which will of course expose the details I was trying to hide.

The info has to be passed, there's no db option. Other people have supposedly written functions that POST the info on from the second page so it's not part of the query string, which would be an acceptable solution, but I can't seem to figure out how to do that.

The ideal would be for the php page to send the users info & the sensitive info to the server, wait for the response, interpret it and write to the page the result.

Any takers?

Thanks

[WestpointStevens]

I use the same kind of logic I am about to present when encrypting/decrypting passwords for users, it's not exactly the same, but I think that it will appply:

You need to first encrypt the arguments before sending them to the querystring.

$lp = $HTTP_POST_VARS['login_password'];
$salt = substr(crypt($login_password), 0,2);
$up = crypt($login_password, $salt);

Then grab the vars from the querystring and uncrypt them (using the $salt) then use them.

Simple, eh?
Hope this works!

[WestpointStevens]

I use the same kind of logic I am about to present when encrypting/decrypting passwords for users, it's not exactly the same, but I think that it will appply:

You need to first encrypt the arguments before sending them to the querystring.

$lp = $HTTP_POST_VARS['lp'];
$salt = substr(crypt($lp ), 0,2);
$up = crypt($lp, $salt);

Then grab the vars from the querystring and uncrypt them (using the $salt) then use them.

Simple, eh?
Hope this works!

[computermonkey]

Hi

Yeah that's the sort of thing I'd like to do, unfortunately I don't have any control over the recipient page so have to send them the data as actual text without any encryption inbetween.

[WestpointStevens]

Use Javascript to call a temp page that executes a function (written by YOU) passing it the plain text data.
The args correspond to form fields in your temp page.
Then call myformname.submit() method to submit the form to your 3rd party db. Then don't forget to close that temp page.

[computermonkey]

Can you expand a bit on it for me it's sounds exactly what I'm looking for. I'd be really grateful if you could do a bit of an example.

Thanks.