Question: I would like to pass php parameters to an html select options tag. it works fine for an input tag using the value attribute as follows:

```
<input type="text" name="to" value= "<?php echo $parameter ?>" size=10> 

```

I tried to do the same for the select tag, but some reason its not working. Below is the select tag:

```
<select name="clinic">
    <option value="<?php echo $clinicName; ?>" >Baylor</option>
    <option value="<?php echo $clinicName; ?>" >IDCC</option>
</select>  

```

Please note that the parameter would need to passed to an sql statement below these above statements as follows:

```
$clinicName = $_POST['clinic'];
$sql = "select * from patients where clinic = '$clinicName'";

```

Answer: 
What you want is to use HTTPS connection to transfer the password from the user to the server safely. Here is the explanation on how to set up the development environment with IIS for HTTPS - [scottgu link](http://weblogs.asp.net/scottgu/archive/2007/04/06/tip-trick-enabling-ssl-on-iis7-using-self-signed-certificates.aspx).

HTTPS protocol will handle the encryption and decryption and you just deal with the plain-text password on the server-side.

After that, on the server side, you compute the hash of the password and compare it to the hash stored in the database. Standard ASP.NET SQL membership provider can be used for this.

There is a good explanation from Jeff Atwood on the problems behind storing and hashing passwords - [coding horror link](http://www.codinghorror.com/blog/2007/09/youre-probably-storing-passwords-incorrectly.html).
If the user's browser in any way knows how to encrypt your password then you kind of lose the point and a smart hacker could extract that encryption.

Using SSL to pass information directly to your application is essentially doing what you're asking and is the accepted secure way to receive the password. You will just have to check against your encrypted version in the database.

Your app receives the password raw (browser and server have taken care of encrypt/decrypt), then your app encrypts it and looks in the database for a match. 

The other way this is done with web services is using a single login step that returns an expiring token which is used for further communication. OAuth is the most popular so do some googling on that.