i want send information in url, how can encrypt on safe way?
this url example: http://www.domain.com/process/?var=1&variable=2
if user knows url can change variabeles, , that's not intention.
i must encrypt it, , decrypt on server think. , safe way this?
edit more info
what want archive phone app (ios in case) communicates web app (which main) using api. url http://www.website.com/api/my_secret_key/get/users, respond json values needed set app, example: http://www.website.com/api/my_secret_key/set/user/score/100
however above url adjusting values easy unwanted. how can done using safe method.
warning: insecure cryptography code follows. a better answer , solution exists on stackoverflow.
class encryption{ private $config; public function __construct( $options=array() ){ $this->config=array_merge( array( 'cipher' => mcrypt_rijndael_256, 'mode' => mcrypt_mode_ecb, 'key' => false, 'iv' => false, 'size' => false, 'base64' => true, 'salt' => false ), $options ); } private function getivs( $config=object ){ $config->size=mcrypt_get_iv_size( $config->cipher, $config->mode ); $config->iv=mcrypt_create_iv( $config->size, mcrypt_rand ); } public function encrypt( $data=null ){ $config=(object)$this->config; $this->getivs( $config ); $data=trim( $data ); $module = mcrypt_module_open( $config->cipher, '', $config->mode, '' ); mcrypt_generic_init( $module, $config->key, $config->iv ); $output = $config->base64 ? base64_encode( mcrypt_generic( $module, $data ) ) : mcrypt_generic( $module, $data ); mcrypt_generic_deinit( $module ); mcrypt_module_close( $module ); return $output; } public function decrypt( $data=null ){ $config=(object)$this->config; $this->getivs( $config ); mb_detect_order( 'auto' ); $encoding=mb_detect_encoding( $data ); if( !$data or is_null( $data ) or empty( $data ) or !$encoding or $data=='' or base64_decode( $data )=='' ) return false; $module = mcrypt_module_open( $config->cipher, '', $config->mode, '' ); mcrypt_generic_init( $module, $config->key, $config->iv ); $output = $config->base64 ? rtrim( mdecrypt_generic( $module, base64_decode( $data ) ),"\0" ) : rtrim( mdecrypt_generic( $module, $data ),"\0" ); mcrypt_generic_deinit( $module ); mcrypt_module_close( $module ); return urldecode( $output ); } }//end class /* prepare data transmission */ $enc=new encryption(array('key'=>'s0m3v3ryr4nd0mt3xt')); $payload=enc->encrypt('var1=value1&var2=value2&var3=value3'); $url='http://www.domain.com/process/?payload='.$payload; /* decrypt */ $payload=$_get['payload']; $decrypted=$enc->decrypt( $payload ); /* process querystring - explode, split whatever.. */
Comments
Post a Comment