PHP - Encrypt A File

Hello!

I've got an issue! I'm trying to pass a very very long variable from JS to PHP through $_GET, but it seems too long for get.

Is there any encryption function that works on both JS and PHP, so I can encrypt it in JS, send it though GET and decrypt it in PHP?

Thanks !

Hey guys!
I have a doubt and this is a question that relates Flash and PHP...

I have a flash (swf) file that grabs/sends variables from/to php.
That swf file is FULLY encrypted and the paths to the PHP urls are also encrypted.

Is there any other way a hacker could find out where and which my PHP files are located/named?

Any ideas, suggestions?
Thanks in advance!
Cheers,

Can php encrypt a link so that it's hidden or expires after a download or x number of days? An example of this use would be on music download sites.

Hi.

I have made a login script, but I would wan't to encrypt the password.
I followed a tutorial and got this:
login.php
<?php
$password = "secret";

echo $password;
/* displays secret */

$password = sha1($password);

echo $password; 
/* displays e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4 */
?>
<form action="validate.php" method="post">
  <label for="username">Username</label>
  <input type="text" name="username" id="username" />
  <br />
  <label for="password">Password</label>
  <input type="password" name="password" id="password" />
  <br />
  <input type="submit" name="submit" value="Submit" />
</form>
<?php
?>

validate.php

<?php
include "setup.php";

/* get the incoming ID and password hash */
$username=$_POST['username'];
$password=$_POST['password']; 
$password=md5($password); // Encrypted Password

/* establish a connection with the database */
$server = mysql_connect("$db_host", "$db_username","$db_password");
if (!$server) die(mysql_error());
mysql_select_db("$database");

  
/* SQL statement to query the database */
$query = "SELECT * FROM users WHERE Username = '$username' AND Password = '$password'";

/* query the database */
$result = mysql_query($query);

/* Allow access if a matching record was found, else deny access. */
if (mysql_fetch_row($result))
  echo "Access Granted: Welcome, $username!";
else
  echo "Access Denied: Invalid Credentials.";

mysql_close($server);  
?>

Its the line $password=md5($password); // Encrypted Password
that messes everything up.
If I delete it and login, everything is fine, if I add it it says Code: [Select]
Access Denied: Invalid Credentials
I need help with this one!
And if someone have time, give me some ideas how to make PHP scripts safer!

Regards
Worqy

How can I encrypt POST data from a form? Basically, I want to ensure that the data on the form is not in plain text ever. Is this possible?

<form method="post">
<input type="text" name="email" size="40">
<input type="password" name="password"/>
...


Basically, when this posts, I want to do a foreach on $_POST and see something like:
password = 1f3870be274f6c49b3e31a0c6728957f
  and not
password = stringTheUserTyped

I hope what I'm asking for is clear.
(PHP 5.2.14)

Thanks!

Hello everyone... I am developing a software as a service program for use by multiple companies, each would have their own instance of the application... The part that I am not really to clear on, is what would be the most secure, with low latency, PHP method of encrypting/decrypting data to and from the database... all data is sent over SSL... I would also want to use a unique key for each company... Access to the program itself is protected from the outside by a user based log in system...

I am currently recoding a website from ASP to PHP.

The aim is for a customer to add items to a cart, fill in their credit card details.
Then an email is encrypted (on the secure website) and sent to the client.

The client then opens the email on her PC and it is decoded either when she opens the e-mail, or downloads an attachment that can be opened by a program
that requires a password. Once entered the order is revealed, the e-mail is decrypted.

I just wondered if anyone has any link to sites where I can download the de-crypting software to install on the clients machine.

Or any other ideas on sending an encrypting email and decrypting on the recipients computer.

Many thanks.

Hi.
I  purchased software for a PayPal subscription management system, and it relies on user verification by way of a username (email address) and a hashed password.

I have also developed my own login scripts for an application which also uses a hashed md5 password and all that works fine. I want to integrate my scripts with the purchased software using the supplied mySql database tables.

My problem is that the supplied software goes a step further than a hashed md5 password by applying initializing vectors to the hashed password. I cannot figure out how to modify my login code to accommodate the encrypted password that appears in the database.

It is beyond my current abilities to work this out on my own. I'd really appreciate it if anyone can help.

I've attached my own login script below, and Ive attached what I believe is the decryption code that comes with the purchased software. There is also a database file that relates to this.

Hope someone can help me.

<?php
session_start();
if ($_POST['password']) {
//Connect to the database 
    include_once "db_connect.php";    
$email = stripslashes($_POST['payer_email']);
$email = strip_tags($email);
$email = mysql_real_escape_string($email);
$password = preg_replace("/[^A-Za-z0-9]/", "", $_POST['password']); // filter everything but numbers and letters
$password = md5($password);
// Make query and then register all relevant database data into SESSION variables.
$sql = mysql_query("SELECT * FROM sec_tblusers WHERE payer_email='$email' AND password='$password' AND signedup='1'") or die("failed"); 
$login_check = mysql_num_rows($sql);
if($login_check > 0){ 
    while($row = mysql_fetch_array($sql)){ 
        // Get member data into a session variable
        $id = $row["recid"];   
        session_register('recid'); 
        $_SESSION['recid'] = $id;
   
        $payer_email = $row["payer_email"]; 
        session_register('payer_email'); 
        $_SESSION['payer_email'] = $payer_email;
        
        $password = $row["password"]; 
        session_register('password'); 
        $_SESSION['password'] = $password;        
           
        $iv = $row["iv"]; 
        session_register('iv'); 
        $_SESSION['iv'] = $iv;
         
        $signedup = $row["signedup"]; 
        session_register('signedup'); 
        $_SESSION['signedup'] = $signedup;
         
        $lastlogin = $row["lastlogin"]; 
        session_register('lastlogin'); 
        $_SESSION['lastlogin'] = $lastlogin;
    
        // Update last_log_date field for this member now
        mysql_query("UPDATE sec_tblusers SET lastlogin=now() WHERE recid='$id'");
        // Print success message here then exit the script
        //header("location: member_profile.php?id=$id"); 
        header("location: adduser.php?id=$id"); 
        exit();
    } // close while
} else {
// Print login failure message to the user and link them back to your login page
  print '<br /><br /><font color="#FF0000">You do not show in our records as a subscriber. Has the subscription expired?</font><br />
<br /><a href="../main.php">Click here</a> to go back.';
  exit();
}
}// close if post
?> 

What I think is the decrypting code that comes with the purchased software goes like this.

<?php 
//---------------------------------------
//Given the payer_email address, return the decrypted password
function getpassword($payer_email, $dbhost, $dbusername, $dbpass, $dbname, $dbprefix, &$message) {

    $dl = new DataLayer();
    $dl->debug=false;
    $dl->connect( $dbhost, $dbusername, $dbpass, $dbname )  or die ( "Database connection error " . $dl->geterror() );
       
    //SELECT password, iv FROM sec_tblusers WHERE payer_email = '" . $payer_email . "'"
    $cols = array("password", "iv");
    $table = $dl->select( $dbprefix."sec_tblusers", "", $cols, "payer_email = '$payer_email'", "" );

    if ($dl->geterror()) {
        $message = "SQL error - user.php ref 58 " . $dl->geterror();
        exit;
    }

    $IV = $table[0]['iv'];
    $password = $table[0]['password'];

    $decryption = new password($IV, $password);
    $decryption->decode();
    $decode = $decryption->getdecodedtext();

    return $decode;

}


//------------------------------------
?> 

The database table is here.

Code: [Select]
-- Table structure for table `sec_tblusers`
--

CREATE TABLE `sec_tblusers` (
  `recid` int(11) NOT NULL AUTO_INCREMENT,
  `payer_email` varchar(100) NOT NULL,
  `password` varchar(50) DEFAULT NULL,
  `iv` int(11) DEFAULT NULL,
  `signedup` int(11) NOT NULL DEFAULT '0',
  `signupdate` datetime NOT NULL,
  `lastlogin` datetime NOT NULL,
  PRIMARY KEY (`recid`),
  UNIQUE KEY `payer_email` (`payer_email`),
  KEY `password` (`password`),
  KEY `signedup` (`signedup`),
  KEY `lastlogin` (`lastlogin`),
  KEY `signupdate` (`signupdate`)
) ENGINE=MyISAM  DEFAULT CHARSET=latin1 AUTO_INCREMENT=22 ;

--
-- Dumping data for table `sec_tblusers`
--

INSERT INTO `sec_tblusers` (`recid`, `payer_email`, `password`, `iv`, `signedup`, `signupdate`, `lastlogin`) VALUES
(5, 'someone@gmail.com', 'cRbeAWgN3 ', 316, 1, '0000-00-00 00:00:00', '2010-11-10 22:29:06'),
(6, 'someoneelse@gmail.com', 'cRbeAWgN3 ', 269, 1, '0000-00-00 00:00:00', '0000-00-00 00:00:00');
I suspect that there may be some other relevant code in the purchased software, and I could hunt that up if someone could tell me what I should look for.

Anyway, I'm really in need of some help, or some advice.

Cheers, everyone.

I have an ecommerce site on shared hosting enviroment. My ecommerce site stores customer data (name, address, email, phone, and item purchase) in mySQL database.

(No super private data like credit card numbers or social security numbers.)

Using openssl (openssl_cipher, iv, etc.), I've been encrypting this customer data and storing the encrypted data in mySQL.

Today, I'm thinking "what's the point." It's like having a lockbox with the key on the wall above...

My thoughts:
1. The "secret cyphers" are located on my server, so if someone hacks my server, they'll get the secret cyphers anyway.
2. Encrypting the Customer Data will add, at the most, 5 extra minutes, for the hacker to find.
3. Perhaps if mySQL was stored on a different server, encrypting may be useful... but mySQL is on same server.
4. On the flipside, if I did get hacked, at least I could demonstrate I tried my best to encrypt what I could...

What do you all think?

Sorry for my bad english. I am not from around these parts.

 

how to get the name of the file including a file from the included file,

This one has me mixed up a bit.. I am trying to record site activity information from a common.php file using a user object. But since the file is included into different php files based on different situations I need a dynamic way of finding the file name that is including it. I could be over complicating things but right now this seems like the best solution other wise I'll have to rewrite the code on every page i write. Is there a function for doing this? Or if someone gets what I'm trying to do if they could point me to the direction of some more information on it.

Thanks.

In this multi file upload form, choose three images, click submit and preview the images on the preview page. If the user wishes to delete or replace an image, click edit and the form will go back to the previous page. Select the replace radio button for example on one of the three images and select a new image from the file input prompt and click submit. The form will go to the preview page again to display the images. During this process the image names are being input into a table and the images are being moved to a directory.

The table is

  `id`  AUTO_INCREMENT,
  `image0`
  `image1`
  `image2`
  `status`

So input name='image[image0]' can be directed to table `image0` and so on.

The code for keep and delete work fine, but how do I replace an image?
I have two foreach blocks. The first one deletes the image file from the directory and deletes the image name from the table, but the second foreach dose not move the new image file into the directory.
Thanks.

<input type='radio' name='image[image0]' value='keep' checked='checked'/>
<input type='radio' name='image[image0]' value='delete' />
<input type='radio' name='image[image0]' value='replace' />
<input type="file" name="image[]" />

<input type='radio' name='image[image1]' value='keep' checked='checked'/>
<input type='radio' name='image[image1]' value='delete' />
<input type='radio' name='image[image1]' value='replace' />
<input type="file" name="image[]" />

<input type='radio' name='image[image2]' value='keep' checked='checked'/>
<input type='radio' name='image[image2]' value='delete' />
<input type='radio' name='image[image2]' value='replace' />
<input type="file" name="image[]" />

<?php
if (isset($_POST['status'])) {

$status = $_POST['status'];
$confirm_code = $status;

#--------------------------- replace --------------------------------------------

if (isset($_POST['submitted']) &&
($image = $_POST['image'])) {

foreach($image as $imageKey => $imageValue) {
if ($imageValue == 'replace') {
$query = "SELECT $imageKey FROM table WHERE status = '$status' ";
if($result = $db->query( $query )){
$row = $result->fetch_array();
}

unlink( UPLOAD_DIR.$row[0] );

$query = "UPDATE table SET $imageKey = '' WHERE status = '$status' ";
}
}

foreach($image as $imageKey => $imageValue) {
if ($imageValue == 'replace') {

$filenm = $_FILES['image']['name']; 
$file = $_FILES['image']['tmp_name'];

move_uploaded_file($file, UPLOAD_DIR . $filenm);
$filename[] = $filenm; 

$query = "INSERT INTO table VALUES ('','$filename[0]','$filename[1]','$filename[2]','$confirm_code')";
}
}
}
}
?>

Hiya,

Firstly, I'm a complete novice, apologies! But I have got my upload.php working which is nice. I will post the code below.

However, I would now like to restrict the file size and file type to only word documents.

I currently have a restriction of 200KB but it's not working - no idea why as I've looked at other similar codes and they look the same.

Also, just to complicate things - can I stop files overwriting each other when uploaded? At the moment, if 2 people upload files with the same name one will overwrite the other.

Is this too many questions in 1?

Any help is very much appreciated!

Code below:

Code: [Select]
<form enctype="multipart/form-data" action="careers.php" method="POST">
        Please choose a file: <input name="uploaded" type="file" /><br />
<input type="submit" value="Upload" />
</form>

<?php 
 $target = "upload/"; 
 $target = $target . basename( $_FILES['uploaded']['name']) ; 
 $ok=1; 
 
 //This is our size condition 
 if ($uploaded_size > 200) 
 { 
 echo "Your file is too large.<br>"; 
 $ok=0; 
 } 
 
 //This is our limit file type condition 
 if ($uploaded_type =="text/php") 
 { 
 echo "No PHP files<br>"; 
 $ok=0; 
 } 
 
 //Here we check that $ok was not set to 0 by an error 
 if ($ok==0) 
 { 
 Echo "Sorry your file was not uploaded"; 
 } 
 
 //If everything is ok we try to upload it 
 else 
 { 
 if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target)) 
 { 
 echo "Your file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded."; 
 } 
 else 
 { 
 echo "Sorry, there was a problem uploading your file."; 
 } 
 } 
 ?>

I'm using an Upload Script, and I've been working on trying to style the 'Choose File Button' (input file button)

Hey everyone, I'm pretty new to this, not my full time job, but just something I thought I'd give a shot...

I have a database, in postgres, in which I make my query and I go fetch all the info I need.
What I need to do next is the tricky part for me.

For each line of results received, I have to output to a text file (.txt) but I have to respect a format that was given to me from the person requesting the info.

Example:
Character 1 must be G or N.
Character 2 to to 11 will be a result from my database search, which is a 10 digit string.
Character 12 to 14 must be spaces.

Another rule is:
start at character 78: input a value from my database search but it must not exceed 20 characters and if it is less then 20 character, fill the remaining with spaces.


If anyways has a code I can copy and work off of I would really appreciate it....thanks!

<td><label for='images'> <b>File to upload:</b> </label></td>
            <td><input type='file'  name = 'drama_image' '<?php echo $row['drama_image']; ?>'/></
                       </tr>
         
   <?php
            $target_path = "images/";
            $target_path = $target_path . basename( $_FILES['images']['name']);

            if(move_uploaded_file($_FILES['images']['tmp_name'], $target_path)) {
                echo "The file ".  basename( $_FILES['images']['name']).
             " has been uploaded";
            } else{
                echo $row['drama_image'];
            }
         
     ?>

['drama_image'] is the name of the file

I wanna echo it out in the box of file upload so when I save , the default picture will still be there instead of being overwritten as the box does not have any value in it.