I'm not sure I follow everything you're saying. But my understanding of the code you posted above is that it allows the password to be sent from the browser to the server either as plain text or encrypted with md5 in case the browser doesn't have javascript enabled. So I think the raw password is blank because it isn't sent if the browser has js enabled and is able to encrypt it (because obviously that would defeat the entire purpose of encrypting it).
|