Posted By

olemedia on 06/03/11

Tagged

data

Versions (?)

Last Edited at 06/03/11 12:29am

Statistics

Viewed 476 times

Favorited by 0 user(s)

Related snippets

Encrypting sensitive data

/ Published in: PHP

Highlighted TextExpand

//The concept is very similar to hashing the value, but now instead we will use a symmetric key to encrypt and decrypt the data.

$key = â€œThis encrypting key should be long and complex.â€;
$encrypted_data = mcrypt_ecb (MCRYPT_3DES, $key, â€œ12345â€, MCRYPT_ENCRYPT);  //encrypt using triple DES
$id = urlencode(base64_encode($encrypted_data));

//The id will be base64 encoded and then urlencoded into Doj2VqhSe4k%3D so we will have the url as

//http://www.example.com/view_profile?id=Doj2VqhSe4k%3D

//(For perl programmer, you can use Digest::MD5 and Crypt::CBC to archive the same output)

//To decrypt the information we received we will do the following:

$id = $_REQUEST["id"]);
$url_id = base64_decode(urldecode($id));

$decrypted_data = mcrypt_decrypt(MCRYPT_BLOWFISH,$key,$url_id, MCRYPT_MODE_CBC, $iv);

//The idea here is to url decode the input id value and follow by base64_decode it and then use back the same algorithm to get the actual data, which is 12345 in this case.

//This same idea can be used on session id to make sure the session id is not tampered with. One caveat to take note is encrypting and decrypting all data send and receive will possibly consume lot of cpu power, so make sure your system is properly size up.

URL: https://www.owasp.org/index.php/How_to_protect_sensitive_data_in_URL%27s

Report this snippet Tweet

Comments

Subscribe to comments

Comment:

You need to login to post a comment.