Secure php database

Hi all. I have an html form, created to remind club members of a forgotten members' area password. That is not the issue though. The issue is that I have member's information in an external .js file. The members' data is obscured and appears like this array snippet {mno:"54",Llast4:"9748",Mlast4:"3752",pc:"149"},
{mno:"56",Llast4:"",Mlast4:"5829",pc:"149"},
{mno:"57",Llast4:"4483",Mlast4:"1983",pc:"148"},
{mno:"59",Llast4:"4798",Mlast4:"7501",pc:"70"},
{mno:"61",Llast4:"1204",Mlast4:"1204",pc:"148"}, and I want to create a .php file, so that prying eyes or bots cannot see this data and my html file will interrogate the .php file to gain confidence of membership authenticty. Where do I go from here. Help someone please. Thanks. idarpe.

Comments

[Alkin Veysal]

Hi idarpe,

You're on the right track by moving the member data out of the JavaScript file. Anything included in JavaScript sent to the browser can be viewed or downloaded, even if the data is obscured.

However, there's an important distinction: the PHP file should validate the submitted information, not return the member records to the browser.

A simple approach would be:

1. Keep your member records in a server-side database or PHP-accessible data file stored outside the public web directory.
2. Have your HTML form submit the information to a PHP endpoint using POST.
3. Let PHP look up the member and validate the submitted details.
4. Return only a generic response, never the member's stored information.

For example, your JavaScript could submit the form data like this:

const response = await fetch('/verify-member.php', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json'
    },
    body: JSON.stringify({
        membershipNumber: membershipNumber,
        verificationCode: verificationCode
    })
});

const result = await response.json();

On the PHP side, you could start with something like:

<?php

declare(strict_types=1);

header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['message' => 'Method not allowed']);
    exit;
}

$input = json_decode(
    file_get_contents('php://input'),
    true
);

if (!is_array($input)) {
    http_response_code(400);
    echo json_encode(['message' => 'Invalid request']);
    exit;
}

// Look up the member using a server-side data source.
// Do not expose the records or their stored verification values.

// Perform the verification and recovery process here.

echo json_encode([
    'message' => 'If the details match our records, recovery instructions will be sent.'
]);

This is only a starting point, not a complete password recovery implementation.

One more important point: The last four digits of personal information are not strong authentication credentials. Someone may be able to guess or discover them.

For password recovery, I'd strongly recommend sending a short-lived, single-use reset link to the email address already registered for that member, rather than displaying or returning their password.

You should also add rate limiting to prevent automated guessing, and avoid revealing whether a particular membership number exists.

So yes, PHP is a good solution here. The key is to keep verification and password recovery entirely on the server.

Hope this helps! A little more detail about how your current form checks those fields would make it easier to suggest the smallest safe change.

[sid sharp]

Many thanks