Hi!
This is the (common and obvious) problem: how to securely send passwords via html forms, in case someone is sniffing your traffic?
Currently, in my web sites, I "encrypt" (md5) the password before submitting the form. Anyway, this does not seem to be a solution, because if you sniff the encrypted password, it is practically the same as sniffing the plain password, since you can HTTP POST it to the server and the result is the same as knowing the plain password.
So, I thought of doing this: instead of sending md5(password), I can send md5(password+session_id). Of course, this would mean that the user must accept the session cookie or anyway must transport the session id as a GET variable. My doubt is I don't know exactly how sessions and session ids work and are managed by php, so I'm not sure that it would be impossible to forge/copy a session id in order to use a previously sniffed encrypted password.
I would like to hear some comments/suggestions :-)
Thank you!

Just use HTTPS for sensitive transmissions.

what is the purpose
does it need to be a secure service or just a simple lock out
for other people to get in?

Take a look at this site: http://www.zubrag.com/scripts/password-protect.php

It seems to have everything one would need to be able to password protect a php site. It allows for password only access and username and password combination access. Omitting the user name sets it up for password only. If you choose to enable cookies the username and password only need to be entered once when accessing the site, otherwise the user will be prompted each time the page is refreshed or another page is selected from the site. The documentation seems to be very clear, and the site that I am directing you to is a forum with questions and answers that will probably enable you to successfully set up the form. I would guess that since it uses PHP it is probably passing plain-text information over the network. To successfully setup a password protected system would require that the password be transmitted with an encryption key. SSL was designed specifically for this purpose.

If you don't need actual security, having the server and some javascript generate some one-time-only nonce or salt would prevent people using the md5 hash to login.

If you need actual security, SSL is the way to go.