Skip to content
PHP Logo

What are the potential security risks of using pop-up password prompts in PHP?

Potential security risks of using pop-up password prompts in PHP include vulnerability to phishing attacks, as users may be tricked into entering their passwords into a fake prompt. To mitigate this risk, it is recommended to use HTML forms with CSRF tokens for authentication instead of pop-up prompts.

php 
<?php
session_start();

// Generate CSRF token
$csrf_token = bin2hex(random_bytes(32));
$_SESSION['csrf_token'] = $csrf_token;

// Display login form
echo "<form action='login.php' method='post'>";
echo "<input type='text' name='username' placeholder='Username'>";
echo "<input type='password' name='password' placeholder='Password'>";
echo "<input type='hidden' name='csrf_token' value='$csrf_token'>";
echo "<input type='submit' value='Login'>";
echo "</form>";
?>

Related questions