POST form values over HTTPS

Question

I'm fairly unfamiliar with HTTPS, but I know it's secure, what I want to know is when a user logs in with details on a form, are the variables in that form (username, password) sent to the server encrypted?

I'm asking this, as I'm using a form to log people in, but I'm also hashing their passwords with MD5 together with a SALT for verification.

Also, is HTTPS secure enough to prevent any spyware running on the host from intercepting the login details?

Sorry for asking a few questions in this post, but thanks in advance for any answers.

Answer 1

I'm fairly unfamiliar with HTTPS, but I know it's secure, what I want to know is when a user logs in with details on a form, are the variables in that form (username, password) sent to the server encrypted?

The entirety of the HTTP request and response are encrypted.

The DNS look-up to convert the hostname to an IP address will, however, not be.

Also, is HTTPS secure enough to prevent any spyware running on the host from intercepting the login details?

No. HTTPS encrypts the communication between the client and the server. It cannot prevent software on the client from interfering with the request or reading the response. This includes the possibility of an attacker intercepting the request for the form and modifying it — so the form must be sent over SSL too.