Encode string in php

1

I'm making a script that encodes a string and saves it in the database. Then check that string in the database to see if the user is registered in the platform.

I currently use sha512 , but I think it's random right?

First I insert a user in the database

$hash= hash('sha512', $string);
query = "INSERT INTO nombre_tabla VALUES(null, '', '', '" . $hash. "', '', '');";

Then when the user logs in, I check that he is in the bbdd

$hash= hash('sha512', $string);
$query = "SELECT id_tabla FROM nombre_tabla WHERE string = '" . $hash . "';";

The problem is that this does not work for me.

Is it because the encryption function I use is random?

    
asked by 01.07.2016 в 09:18
source

2 answers

1

You have some error with the encoding. Follow the example I give you, because I think you have an error or with the spaces in the password or that you do not keep the password and it is random (and then you can not recover it)

Following the above in this answer a good and quick way to do it is, starting from the password:

$key = 'password to (en/de)crypt'; //Aquí pon lo que quieras y guárdalo en algún sitio dónde solo TU tengas acceso.
$string = ' string to be encrypted '; // fíjate en los espacios

The variable key is the KEY that you should NEVER give to anyone and that you can give the value you want without problem. The variable string is what we want to code. With sha256 there is more than enough.

  • Encryption

    $iv = mcrypt_create_iv(
        mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC),
        MCRYPT_DEV_URANDOM
    );
    
    $encrypted = base64_encode(
        $iv .
        mcrypt_encrypt(
            MCRYPT_RIJNDAEL_128,
            hash('sha256', $key, true),
            $string,
            MCRYPT_MODE_CBC,
            $iv
        )
    );
    
  • Decryption

    $data = base64_decode($encrypted);
    $iv = substr($data, 0, mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC));
    
    $decrypted = rtrim(
        mcrypt_decrypt(
            MCRYPT_RIJNDAEL_128,
            hash('sha256', $key, true),
            substr($data, mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_    MODE_CBC)),
            MCRYPT_MODE_CBC,
            $iv
        ),
        "
    $key = 'password to (en/de)crypt'; //Aquí pon lo que quieras y guárdalo en algún sitio dónde solo TU tengas acceso.
    $string = ' string to be encrypted '; // fíjate en los espacios
    
    " );
  • answered by 01.07.2016 в 09:30
    0

    First, the sha512 function is not a random function. If you pass it once or thousands of times the same string, it will always return the same hash. If you run the following command in your console, you will verify:

    for i in $(seq 1 20); do php -r "echo hash('sha512', 'hola') . PHP_EOL;"; done 
    

    It is important to understand that the functions sha *, md5, etc are asymmetric algorithms: You can not recover the original value from the generated hash.

    It is always advisable to use prepared statements , so that your parameters can be escaped when you select or insert in the BD (in this case using PDO).

    Specifically, and assuming that you use PDO, you should do something like the following:

    $conn = new PDO(...);
    
    $stm = $conn->prepare("INSERT INTO nombre_tabla VALUES(null, '', '', ?, '', ''");
    
    $hash = hash('<algoritmo escogido>', $string);
    $stm->execute(array($hash));
    

    and then to select:

    $stm = $conn->prepare($query = "SELECT id_tabla FROM nombre_tabla WHERE string = ?");
    
    $hash = hash('<algoritmo escogido>', $string);
    $stm->execute(array($hash));
    

    In addition, it is important to mention that the function hash returns a string in hexadecimal format, so it is not necessary to apply any further extra transformation ( base64 for example).

    It occurs to me that the problem you may have is that your field in the database has a shorter length than that generated by the hashing function. Note that sha512 generates a 128-character long hash:

    $ php -r "echo strlen(hash('sha512', 'hola'));" # correr en una consola
    

    so it is cut when saving and when you try to recover it, compare a shorter string with a longer one.

        
    answered by 01.07.2016 в 10:17