通过JavaScript AJAX向PHP发送密码的正确方法是什么？

Question

I have tried a few methods, I have confirmed that it's a special character problem ie. I tried a simple password combination that only included letters/numbers and that worked.

Since I stopped using jQuery this is the first time I've had a problem where password_verify would not work. I did make sure as I mentioned above it wasn't anything wrong with password_verify.

So I get my password input and I join it with the username like this:

var params = null,
    paramObj = {};
paramObj['user'] = loginInpUser.value;
paramObj['pass'] = loginInpPass.value;
params = encodeURI('post_params='+JSON.stringify(paramObj));

On the PHP side I receive this in POST like so:

$post_params = json_decode($_POST['post_params'], true);
$user = $post_params['user'];
$pass = $post_params['pass'];

I did make sure I get matching values from what I send on the client side, to what PHP gets ie. echo out $user and $pass, they match exactly... the special characters in question are:

)(#$$%)(

I haven't even tried to throw in a & in there which may cause problems with how you concatenate the parameters before sending them with an XMLHttpRequest.

So what is the right way to do this where special characters are still parsed correctly (password_verify matches hash with password)?

There is a reason to not use jQuery for me it was to lower file download speed-use async tags.

Edit:

Weird thing with hashes:

I just needed a basic login system so I didn't bother with a register form, I created a hashing function that used password_hash and inserted it into a db. I noticed that using

$pass = "password with special chars";

Would fail, the error would say that something inside the string was an undefined variable (string is cut up, I guess a parsing error).

But using

$pass = 'password with special chars';

This was fine.

Answer 1

You should either send the entire request as JSON, or URL-encoded; a mix of both is rather weird:

var params = 'user=' + encodeURIComponent(loginInpUser.value) + '&pass=' + encodeURIComponent(loginInpPass.value);

$user = $_POST['user'];
$pass = $_POST['pass'];

Or:

var params = JSON.stringify({ user: loginInpUser.value, pass: loginInpPass.value })

$params = json_decode(file_get_contents('php://input'), true);
echo $params['user'], $params['pass'];

This properly preserves arbitrary "special" characters correctly.