MySQL/SQL Server vs. PHP encryption -
according documentation, most-secured encryption methods are:
aes_encrypt()
mysql
encryptbypassphrase()
sql server
mc_encrypt()
php
which 1 should used?
recently on many blogs , e-magazines being posted information, pre-encryption php best way, since if my/sql server compromised, attacker can scan logs.
example of mcrypt pre-encrypting string before database insertion (vs others):
<?php define('encryption_key', '555d6c18e7b8aa109bfda854df942088a9984cccf2a979bd21b99e50aedc1976'); function cryp($action, $string, $key) { $key = pack('h*', $key); if($action == 'en') { $string = serialize($string); $iv = mcrypt_create_iv(mcrypt_get_iv_size(mcrypt_rijndael_256, mcrypt_mode_cbc), mcrypt_dev_urandom); $string = base64_encode(mcrypt_encrypt(mcrypt_rijndael_256, $key, $string . hash_hmac('sha256', $string, substr(bin2hex($key), -32)), mcrypt_mode_cbc, $iv)) . '|' . base64_encode($iv); } if($action == 'de') { $string = explode('|', $string); $iv = base64_decode($string[1]); $string = unserialize(substr(trim(mcrypt_decrypt(mcrypt_rijndael_256, $key, base64_decode($string[0]), mcrypt_mode_cbc, $iv)), 0, -64)); } return $string; } $data = 'sample string here'; $encrypted = cryp('en', $data, encryption_key); $decrypted = cryp('de', $encrypted, encryption_key); echo $encrypted; ?>
Comments
Post a Comment