title: Is this password protected download script secure?
body: <p>I developed an upload script which has the possebility to set up a password.
  Now i want to know, how secure is it against users who are looking into the sourcecode?</p>
  
  <p>My way of thinking was to put the file for download in a folder with a long name. This foldername is a md5 hash which is the former password.</p>
  
  <p>like: <a href="http://www.examlpe.com/098f6bcd4621d373cade4e832627b4f6/my_file.zip" rel="nofollow noreferrer">http://www.examlpe.com/098f6bcd4621d373cade4e832627b4f6/my_file.zip</a></p>
  
  <p>Now, the user can type a password on my website into an input field and a jquery script makes a md5 hash from it.</p>
  
  <p>My foldername md5 hash comes from a mysql database.</p>
  
  <p>Now i make another md5 hash from both md5 hashes ("user input hash" and "database hash") and compare both. If they're equal, the script shows the path to the protected file for downloading, using the jquery md5 hash from the user input.</p>
  
  <pre><code>window.jQuery.("#my_id").click(function() {
  var inputPassword = //input value of password field "e.g.: test";
  Password = md5(inputPassword); //is 098f6bcd4621d373cade4e832627b4f6
  md5_Password = md5(Password) //is fb469d7ef430b0baf0cab6c436e70375
  
  //Compare#####
  if (md5_Password == 'fb469d7ef430b0baf0cab6c436e70375') //hash from the mysql database
  {
    //show the Link 
    //http://www.examlpe.com/ + Password + /my_file.zip
  }
  
  });
  </code></pre>
  
  <p>I know, if somebody knows the foldername, he is able to get the file but this is not for real secret stuff. It should only protect the file for a (sourcecode looking) user from downloading it.</p>