Password Protect

[techoveride]

I have a password protected web page and the password protection works but I am trying to get the page to load the protected page in an iFrame and I can't get that to work. What do I need to change to make the the protected page load in target="main"?

Here is my code:

<center><form name=login>
<table border=1 cellpadding=3>
<tr><td colspan=2 align=center><font size="+2"><b>Members-Only Area!</b></font></td></tr>
<tr><td>Username:</td><td><select name=memlist>
<option value='x'>
<option value='testuser¦54139¦OETTPTOY target="main"'>testuser
</select></td></tr>
<tr><td>Password:</td><td><input type=password size=10 maxlength=8 name=pass></td></tr>
<tr><td colspan=2 align=center><input type=button value="Login" onclick="check(this.form)"></td>
</tr>
</table>
</form>
<SCRIPT LANGUAGE="JavaScript">
<!-- Begin
var params=new Array(4);
var alpha="ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHI";
function check(form) {
which=form.memlist.selectedIndex;
choice = form.memlist.options[which].value+"¦";
if (choice=="x¦") {
alert("Please Select Your Name From The List");
return;
}
p=0;
for (i=0;i<3;i++) {
a=choice.indexOf("¦",p);
params[i]=choice.substring(a,p);
p=a+1;
}
h1=makehash(form.pass.value,3);
h2=makehash(form.pass.value,10)+" ";
if (h1!=params[1]) {
alert("Incorrect Password!"); return; };
var page="";
for (var i=0;i<8;i++) {
letter=params[2].substring(i,i+1)
ul=letter.toUpperCase();
a=alpha.indexOf(ul,0);
a-=(h2.substring(i,i+1)*1);
if (a<0) a+=26;
page+=alpha.substring(a,a+1); };
top.location=page.toLowerCase()+".html";
}
function makehash(pw,mult) {
pass=pw.toUpperCase();
hash=0;
for (i=0;i<8;i++) {
letter=pass.substring(i,i+1);
c=alpha.indexOf(letter,0)+1;
hash=hash*mult+c;
}
return(hash);
}
// End -->
</script>

[Dijkgraaf]

For starters I wouldn't do the password validation in JavaScript. It just isn't a secure method and can be bypassed.

[techoveride]

WHat would be the best way to do a password protected area in a website?

[coopster]

A very simple but not very secure method of password protecting a site is Apache's Basic Authentication. You can read all about it in the Apache document titled Authentication, Authorization and Access Control [httpd.apache.org]. It is important to be aware, however, that Basic authentication sends the password from the client to the browser unencrypted. This method should therefore not be used for highly sensitive data.

But once you realize the importance of secured pages and how to handle users and authentication you will likely move toward server-side solutions and secured protocols (HTTPS) using server-side languages such as PHP.