Advanced Search

Return to Snippet

Revision: 47227
at June 3, 2011 00:29 by olemedia
Initial Code 
//The concept is very similar to hashing the value, but now instead we will use a symmetric key to encrypt and decrypt the data.

$key = “This encrypting key should be long and complex.”;
$encrypted_data = mcrypt_ecb (MCRYPT_3DES, $key, “12345”, MCRYPT_ENCRYPT);  //encrypt using triple DES
$id = urlencode(base64_encode($encrypted_data));

//The id will be base64 encoded and then urlencoded into Doj2VqhSe4k%3D so we will have the url as

//http://www.example.com/view_profile?id=Doj2VqhSe4k%3D

//(For perl programmer, you can use Digest::MD5 and Crypt::CBC to archive the same output)

//To decrypt the information we received we will do the following:

$id = $_REQUEST["id"]);
$url_id = base64_decode(urldecode($id));

$decrypted_data = mcrypt_decrypt(MCRYPT_BLOWFISH,$key,$url_id, MCRYPT_MODE_CBC, $iv);

//The idea here is to url decode the input id value and follow by base64_decode it and then use back the same algorithm to get the actual data, which is 12345 in this case.

//This same idea can be used on session id to make sure the session id is not tampered with. One caveat to take note is encrypting and decrypting all data send and receive will possibly consume lot of cpu power, so make sure your system is properly size up.
Initial URL 
https://www.owasp.org/index.php/How_to_protect_sensitive_data_in_URL%27s
Initial Description 

                                

                                                            

                                    

                                        

                                        Initial Title
                                        

                                    

                                    
Encrypting sensitive data

                                

                                                            

                                    

                                        

                                        Initial Tags
                                        

                                    

                                    
data

                                

                                                            

                                    

                                        

                                        Initial Language
                                        

                                    

                                    
PHP