CODEWITHSUNDEEP
phpencryption
Shawn
Shawn

Reputation: 34269

How to encode/encrypt secret data to be transferred by URL parameters?

Here's the story:

I have to pass some classified information from one script to another script. In the first script I need to encrypt the data first and then I have to attach the encrypted data into a GET request and send it to another script. The URL would look like this:

http://mydomain.com/mysecondscript.php?secret={encrypted stuff}

My current encrypt method is based on base64. The problem with this method is, that if I have a lot of stuff to encrypt, the encrypted result could get very long. If it's longer than 255 characters or so, the second script will not be able to decrypt it because the string will be chopped.

So I'm looking for a better encryption method, that can control the length of the encrypted result.

Upvotes: 4

Views: 14188

Answers (5)

Okwo moses
Okwo moses

Reputation: 95

You can use MD5 to create a hash of the id so you get something like:

http://www.demo.com/displaycommittees.php?id=81dc9bdb52d04dc20036dbd8313ed055

In your db query you can do a select on the users table including a WHERE statement that also hashes the id column like:

WHERE MD5(id) = $_GET[id]

This works fine and i have always applied this algorithm. for instance assuming the actual value of the encrypted id 23, if you try to put 23 in place of the encrypted(hash) code it will not work( no result will be display).

Note: Reasons are best known to those who need a solution, so the question "why" may not come in for those who need it. they only ask for a solution and if it works fine for them, nice. But for transaction application (e.g cash transaction or transaction pins) please do avoid passing sensitive information via URL, because it can easily be cracked.

Upvotes: 0

NullUserException
NullUserException

Reputation: 85478

DANGER!

Base64 is NOT a form of encryption, but encoding. Base64 encoded strings are easy to recognize and trivial to decode. Base64 is used to encode data so they can be safely transmitted across non-binary safe medium (such as URLs and emails), but they do not hide the data itself.

What you need to do is encrypt the string using AES (see PHP's mcrypt), then base64 encode it. This of course will not solve your length problem. The question is pretty vague, but what you can do is:

  • Use POST instead of GET.
  • Store data in a database or a file which both scripts can access. Then just generate a sort of identifier and send it with the URL. The receiving script can use this identifier to retrieve the data. As an added bonus you won't have to send classified data with the URL.

EDIT: Now that I read your question more carefully, it seems like both scripts are sitting on the same server. In this case there is no reason whatsoever to pass this data via HTTP.

Upvotes: 16

President James K. Polk
President James K. Polk

Reputation: 42018

No matter how secure your encryption scheme is you will still need to base64 or URL-encode the result which, you have discovered, will likely exceed 255 characters. The best you can do is compress the data, then encrypt it, then encode it. It will still probably fail. You need to find an alternative to GET.

Upvotes: 2

Kyle Ross
Kyle Ross

Reputation: 2160

If this is sensitive information, base64 should not be used as it can be decoded easily. If you want the information to be securely encrypted, you shoule use PHP Mcrypt (link). Much more secure and can support encryption of much longer strings. Best of all, you set your own key and it cannot be decrypted without that key. It make require a tiny bit more work, but it will be safe. Also, if you are passing multiple variables that way, you can set them into an array, serialize and encrypt the array, pass the array via GET, and then decrypt/unserialize. It's as simple as that. One last thing, there are also some classes out there that will make Mcrypt a lot easier to use. May want to google to find one, it will make your life easier.

Upvotes: 0

habnabit
habnabit

Reputation: 10304

Why does it have to be transmitted in the URL at all? Save it to disk, put it in the database, add it to a message passing queue...

You can use an opaque token in the URL to identify which thing you're talking about, and then turn that token back into a useful thing on the other end by querying whatever storage mechanism you choose.

Upvotes: 0

Related Questions