php - Getting username and password exposed in POST parameters when created a new user -

i need hash , store password user input in login form in yii. if them thru post parameters this:

$model->username=$_post['user']['username']; $model->password=crypt($_post['user']['username']);// salt might added if($model->save())   $this->redirect(array('view','id'=>$model->id)); 

this way expose uncrypted password in post request. other way them directly login form this:

public function actioncreate2() {     $model=new user;     $model->username = $form->username;     $model->password = crypt($form->password);     if($model->save())             $this->redirect(array('view','id'=>$model->id));      $this->render('create',array(         'model'=>$model,     )); } 

but does not work in case authenticating saved user. auth function:

public function authenticate() {     $users = user::model()->findbyattributes(array('username'=>$this->username));      if($users == null)         $this->errorcode=self::error_username_invalid;     elseif ($users->password !== crypt($this->password, $users->password))     //elseif($users->password !== $this->password)         $this->errorcode=self::error_password_invalid;     else         $this->errorcode=self::error_none;     return !$this->errorcode; } 

how in proper way?

the more troubles appeared followed suggest of samuel - validating alarm message before enter anything, along hashed password in input field.(see picture):

when still enter username , password instead of 'proposed' , press 'create' form being sent not crypted values (from post request sniffing):

form data   view source   view url   encoded yii_csrf_token:9758c50299b9d4b96b6ac6a2e5f0c939eae46abe user[username]:igor23 user[password]:igor23 yt0:create 

but nothing stored in db, nor crypted not uncrypted...

change create method to:

/**  * creates new model.  * if creation successful, browser redirected 'view' page.  */ public function actioncreate() {     $model = new user;      if (isset($_post['user'])) {         $model->attributes = $_post['user'];         $model->password = crypt($model->password, 'mysalt123');          if ($model->save())             $this->redirect(array('view', 'id' => $model->primarykey));     }      // reset password field     $model->password = "";      $this->render('create', array(         'model' => $model,     )); } 

change elseif this:

elseif ($users->password !== crypt($this->password, $users->password)) 

to this:

elseif (strcmp(crypt($this->password, 'mysalt123'), $users->password))