How safe is it to send a plain text password using

Question

Maybe the title is badly phrased but couldn't think of a better way of saying it.

I am working on a login system at the moment (nothing formal, just experimenting) and was planning on using PHPLiveX (an AJAX library) for some features. Basically you create some PHP functions which are then called via JavaScript. You can add parameters (getElementById) to the JavaScript that are transfered to the PHP function.

What I really wanted to know is whether it is safe to just call the function from JavaScript without encrypting the password first, then letting the PHP function encrypt it (SHA256 in this case). Can the data transfered via AJAX be intercepted? If so how likely is this?

Answer 1

Make sure the target of your AJAX call is a trusted HTTPS:// page and you've made it every bit as secure as any of the other sends of the same information that the rest of your application is doing. Most libraries / frameworks don't limit you to just HTTP:// for your AJAX calls.