how to ensure php/html login form does not load values in the username and password fields

Question

I have written this simple php code (see below). The problem is that when i try running this code, the form loads values into both the username and password input fields. I have tried setting autocomplete = "off" in both the form tag and the input tag as suggested here but it does not seem to work. My browser if firefox 38.0 for Ubuntu canonical 1.0. What is the problem here?

<?php

if (isset($_POST['submit']) && !empty($_POST['username']) && !empty($_POST['password'])){echo "yesu";
  $username = $_POST['username']; 
  $password = md5 ($_POST['password'] . 'ijdb');
  print "welcome $username";
/*header ('Location: .');
exit();*/

  }
    else{
?>
<form action = "" method = "post" autocomplete = "off">
Username: <input type = "text" name = "username" autocomplete = "off"/><p>
Password: <input type = "password" name = "password" autocomplete = "off"/><p>
<input type = "submit" name = "submit" value = "login"/>
<form>
<?php
  }
?>

possible duplicate of http://stackoverflow.com/q/2530/4323504 — Luthando Ntsekwa, May 27 '15 at 06:54
@Luthando Loot. I have pointed this out in my question by citing the thread with a link. Clearly as you can see, the autocomplete = off does not work for my case — Maina Mailu, May 27 '15 at 07:16

score 2 · Accepted Answer · edited May 27 '15 at 08:05

2

Put a hidden empty text field between username and password

<input type="text" name="username">
<input type="text" style="display:none">// like this 
<input type="password" style="display:none">// Introducing this line ensures that whenever you load the form the password field is blank
<input type="password" name="password">

Explain

It will make the username text field not to show any previously typed words in a drop down. Since there is no attribute like name, id for the input field it wouldn't send any extra parameters also.

edited May 27 '15 at 08:05

Maina Mailu

73
3
13

answered May 27 '15 at 06:58

Saty

21,683
7
29
47

please explain what will that text field do – Luthando Ntsekwa May 27 '15 at 07:01
thanks for the explanation, i cant really test it though....@Alex, please let me know if this works – Luthando Ntsekwa May 27 '15 at 07:16
@Saty...your solution works fine for username. How about for password type? – Maina Mailu May 27 '15 at 07:32
@saty...yes it is not working for password field but working for username field – Maina Mailu May 27 '15 at 07:37
add this line / after password filed and try – Saty May 27 '15 at 07:40
@saty adding the after password hides the whole input field – Maina Mailu May 27 '15 at 07:53
@AlexMaina add in before and try – Saty May 27 '15 at 07:55
Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/78868/discussion-between-alex-maina-and-saty). – Maina Mailu May 27 '15 at 07:55
@AlexMaina you are welcome !! enjoy also told Luthando loot about this – Saty May 27 '15 at 08:02

score 0 · Answer 2 · answered May 27 '15 at 06:55

0

Use placeholders

Username: <input type = "text" name = "username" placeholder = "username"/>
Password: <input type = "password" name = "password" placeholder = "password"/>

answered May 27 '15 at 06:55

Babar

896
2
11
29

i have used them placeholders as suggested but still the form loads values...@Babar – Maina Mailu May 27 '15 at 07:19

score 0 · Answer 3 · answered May 27 '15 at 06:58

0

seems like some preset in your browser(check addons or whatever), anyway if you wish to get rid of it - just use custom names for inputs, aka:

Username: <input type = "text" name = "uname" autocomplete = "off"/>

or

Username: <input type = "text" name = "something_unusual" autocomplete = "off"/>`

answered May 27 '15 at 06:58

Dmytro

114
4

Thanks @Dimas i have tried using custom names but still not getting desired results – Maina Mailu May 27 '15 at 07:23
just as extreme measures if nothing else will not help - generate some random UI per form render. – Dmytro May 28 '15 at 08:28

score 0 · Answer 4 · answered May 27 '15 at 07:02

There are three things you can try:

<form autocomplete="off">

Ensure that when you are using autocomplete="off" that you an html5 declaration:

<!DOCTYPE html>

Lastly, it might also be browser settings remembers especially passwords and username combinations

how to ensure php/html login form does not load values in the username and password fields

4 Answers4