then how do you guarantee the form is going to submit to an SSL-protected resource? the form and all of your javascript has to be sent over SSL, otherwise any of it can be tampered with to simply bypass your logic and post the form contents to an unencrypted resource.

if you haven't already seen it, watch moxie's blackhat presentation about ssl:

https://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.htm...