[NickyDee]

Originally Posted by lennix

Somebody told me that at the moment I click on login the password is already hashed using javascript. Is that true? Because then I have to give up and create another page for registration on the game server. I could run it inside vBulletin so that the players are forced to sign up on our boards.

But if the password is hashed on the backend using php I could grep it and work with it.

I'm fairly certain the hash is achieved with javascript. This means that the password is hashed before it leaves the page (so the password isn't vulnerable if its intercepted during the exchange).

I would consider setting this up as something like a compulsary user profile field on signup that is passed to your game server when they login. If your current users haven't completed the field then they get an error message or even a redirect to complete the compulsary field.