Protect user passwords during signup and login.

Hey Robert, This is the exact reason for using a secure (SSL) connection. Sign-up pages (and log-in pages, and any page that deals with sensitive information) should use SSL. Doing so means that no one can "sniff" the information that is sent from the sign-up page to your server. You'd make that happen by buying and installing an SSL certificate on your site, and making sure that whenever someone visits your sign-up page, they use the https:// protocol.

Now, re: sending that information page-to-page: you shouldn't keep sending the info at all! It should be sent once, on the signup page, and then you switch to a persistent session value. Here's the basic idea:

1. User fills out your form on signup.php, clicks "submit."
2. The form inputs are sent to the processing script on your server (signup_process.php), which validates that all fields are complete and valid, then (if the data is good) executes a database (SQL) query to add that person's info to your database. (Side-point: Your processing script should also "hash" the submitted password and store that hash in the database instead of the actual password. If you need more info about this, let me know.)
3. At the end of that processing script, some kind of "isLoggedIn" variable should be stored in your site's $_SESSION scope. Something like:

$_SESSION['isLoggedIn'] = 1;
$_SESSION['user_id'] = 123456; // this value should be generated dynamically

The "user_id" would be set to whatever the user's ID is. If you're using MySQLi, you could get that value automatically with mysqli_insert_id(). If you're using PDO, you could use lastInsertId().

Note: You have to initialize sessions before you can use them. At the top of **every* page that needs to pull data from a session (in other words, at the top of every page in your site) you need to call:*

session_start();

...and it needs to be called before absolutely anything that gets output to the browser (even white space).

Then you can just pass that session value page to page, and validate/contextualize pages based on this persistent session value, instead of against the submitted username and password, over and over page to page. Doing this is much safer (although not perfectly safe, since there is such a thing as session hijacking -- pretty advanced hacking), but at least this will protect people's login information. I should also add that this is how most sites actually do handle logins and sign-ups, so I'm not just saying how I do things.

Final tip: You don't have to use https:// on every page in your site, just the ones that send sensitive information. So /signup.php should use SSL, but /index.php doesn't need to (unless there's a sign-in form on it).

Hope that gives you plenty to work with!