ssl - securing portion of website

[ibexpiotr]

scenario:
we have a website with different forms. in certain forms users fill in personal information, we want to secure the transaction with ssl. how do we go about doing this, we dont want the whole website to be https, just certain pages containing the forms

 

[ibexpiotr]

update:
i know that the action on the form page should look something like <form action="https://blahblhahh....>
how do i make the receiving page ssl secure, without securing the whole website thus slowing down the page.

 

[TristanPerry]

update:
i know that the action on the form page should look something like <form action="https://blahblhahh....>
how do i make the receiving page ssl secure, without securing the whole website thus slowing down the page.

What exactly do you mean by "receiving page"? Since the action="" is the form's 'receiving page' (assuming you mean where the form's query goes), and thus what you've listed should work since you're forwarding to an SSL page. Is this not happening? If not, do you get any errors?

 

[ibexpiotr]

nothing is setup yet with ssl. i like to make sure i got the right idea of how this should be setup before we move with anything.
we have a form that users submit their information into,..and im guessing it gets put into a database...im not sure since i havent worked on this, and all i know is that they want me to figure out a way for the information to be submitted/transfered securely (with https)

 

[TristanPerry]

Ah okay. Well yep, what you've said is the right way to go about it (I did a quick Google search and HTML Form Tutorial: Advanced topics on HTML forms seems a reputable site which suggests this exact method)

And as an FYI (since you said "we dont want the whole website to be https, just certain pages containing the forms" in the OP), it's worth pointing out that once SSL is setup, the whole website *can* be https. It's your choice. As in, if your homepage is http://www.example.com/index.php, once you have SSL setup you can naturally still use http://www.example.com/index.php, however you can also go to https://www.example.com/index.php which will transmit via SSL instead. (Naturally your internal links will be pointing to standard http so it's kind of a moot point, I just wanted to bring it up as an FYI)

So anywhoo, once SSL is setup you can still have the website in standard http as normal - including the page with the form.

Then you (as you rightly pointed out) set the form's action to be https and that'll send just the form's data submission via SSL. (Then the receiving page can put the data into a database as needed).

Hope this makes sense, apologies if not!

 

[ibexpiotr]

thanks, thats pretty much what i thought, just wanted to be reassured.
thanks alot

 

[TristanPerry]

No worries, glad to have helped