using codeigniter and javascript pass encrypted parameters from view to controllers Error

Question

I'm trying to build a login form using codeigniter and jquery, what i was trying to do when client submit the form is the jquery change the window.location calling the validation function in the controllers passing both the username and password parameters ENCRYPTED

Here is my code

window.location.href = "/resturant/codeigniter/index.php/welcome/checklogin/" +
<?php $this->load->library('encrypt');
echo $this->encrypt->encode("$('#username').val()"); ?> +
"/" + $("#password").val();

This code doesn't work.

My question is, is this is how we encrypt parameters and pass them through the url?

UPDATE

The following code works fine thought:

window.location.href = "/resturant/codeigniter/index.php/welcome/checklogin/" +
<?php echo "$('#username').val()"; ?> + "/" + $("#password").val();

Answer 1

You're mixing PHP and JavaScript in a way that is completely impossible. PHP is executed on the server , content is sent to the browser, and then, a long time later, JavaScript is run on the client's machine. The two cannot interact in this way. For PHP and JavaScript to interact at all, data has to be sent between the client and server via HTTP requests.

In the larger-scheme of things, you can't use server-side encryption in PHP to encrypt something client-side in JavaScript. You need to use SSL if you have any hope at all of securely communicating something to the server from JavaScript.

If you're simply trying to keep the username/password out of the URL, you should be using POST requests instead of GET requests. You should be doing this anyways for loggin in users.

RE: Your update

The problem is that, purely by accident , your second example outputs valid JavaScript which happens to give you the desired result.

That is, in your second example:

window.location.href = "/resturant/codeigniter/index.php/welcome/checklogin/" +
<?php echo "$('#username').val()"; ?> + "/" + $("#password").val();

The PHP echo is outputting a static string containing "$('#username').val()" , not the value in the #username field which doesn't exist yet , because we're in PHP and there isn't even a browser involved at this point. The output from PHP will look like this, which coincidentally happens to work correctly:

window.location.href = "/resturant/codeigniter/index.php/welcome/checklogin/" +
$('#username').val() + "/" + $("#password").val();

However, your first example is completely broken. This line:

echo $this->encrypt->encode("$('#username').val()");

is outputting the encrypted form of the literal string "$('#username').val()" ; the result is going to be garbage and JavaScript parse errors.

You cannot mix PHP and JavaScript like this.