About sending form-data to an email address

[a.jenery]

Why is sending form-data (via a typical html form) to an email address insecure, or less secure; and conversely, why is sending form-data online (to a database held on the host server) more secure?
Is this simply down to SSL, or is it more than this? Also, is it possible to send form-data to an email address securely?

[craig]

It does not matter where the form is going, be it a database or email.
What matters is the server the form is on, and how it is being sent.
If the form is on a SSL secure server it means that all the information which is sent via the form is encrytped so that if anyone intercepts it, it cannot be easily read. I say "easily" because there are many pro hackers that can easily decrypt a 128 bit encrytion.
If the form is uses the "mailto" function to send the details, it is highly insecure. You should always use something like the "post" function, and send it through a PHP script.
You have to remember that ABSOLUTELY NOTHING is completely secure on the internet, but there are some methods which are moer secure than others. Sending a form through a PHP script is often enough to send user details, however when processing things like creidt card details, ALWAYS use an SSL server.

Craig

[a.jenery]

Great - so providing that the server uses SSL, I could have form data sent to an email fairly securely. Many thanks for that.
If I use the 'post' submission method (I take it, this is as opposed to the 'get' methode) and send the form/form-data through a PHP script, should I have the PHP code/script embedded in the html page itself within PHP tags, or should the script be a standalone .php file?
In either case (sorry to ask all these questions), what do I put in the form's action-field?

[sypher]

If your using post method php does encrypt data on transfer.

You can embed the php into the form itself and set the action to itsself.
For example if you have form.php which the user fills in you can put.

Code: Select all

form action="form.php"

Then above your form you can use

PHP: Select all

<?php 
if (isset($_POST['submit'])) {
//Do whatever with the form
?>

Providing you keep the submit buttons is

Code: Select all

name="submit"

[benbramz]

what information would you be sending?