Data encryption in PHP

password_hash

https://blastcoding.com/en/data-encryption-in-php/#password_hash

creates a password hash

Description / Descripción

 password_hash(string $password, string|int|null $algo, array $options = []): string

$password – the password of the user who is registering.

$algo – is the algorithm we will use. One of the supported algorithms.

$options – options that the algorithm has.

Let’s see an example of password_hash.

<?php

// Configuración de la base de datos
$host = 'localhost';
$dbname = 'nombre_base_de_datos';
$username = 'usuario';
$password = 'contraseña';

try {
    // Conexión a la base de datos utilizando PDO
    $pdo = new PDO("mysql:host=$host;dbname=$dbname", $username, $password);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    
    // Datos del usuario (nombre, email y contraseña)
    $nombre = 'Juan';
    $email = 'juan@example.com';
    $contrasena = 'contraseña_segura';
    
    // Hash de la contraseña utilizando password_hash
    $hashedPassword = password_hash($contrasena, PASSWORD_DEFAULT);
    
    // Preparar la consulta SQL para insertar datos en la tabla de usuarios
    $statement = $pdo->prepare("INSERT INTO usuarios (nombre, email, contrasena) VALUES (:nombre, :email, :contrasena)");
    
    // Vincular parámetros
    $statement->bindParam(':nombre', $nombre);
    $statement->bindParam(':email', $email);
    $statement->bindParam(':contrasena', $hashedPassword);
    
    // Ejecutar la consulta
    $statement->execute();
    
    echo "Usuario registrado correctamente.";
} catch(PDOException $e) {
    // En caso de error, mostrar el mensaje de error
    echo "Error: " . $e->getMessage();
}

I know I should create a form and validate the inputs and other things, but for practical purposes, this example should suffice to understand how to use it.

If you’re more experienced in the field, you might wonder what happens with the salt that is used.

Starting from one of the new versions of PHP, the salt is included within the same column as the password, which is recommended on the official PHP website. In fact, in PHP 8, the salt you provide to the function will not be considered.

The password column will have the following:

If you want to delve deeper into the topic, I recommend reading this: https://www.php.net/manual/en/faq.passwords.php

password_verify

https://blastcoding.com/en/data-encryption-in-php/#password_verify

The password_verify function verifies that a password matches a hash.

Its general use is to verify if a password entered by a user or during login matches the hash associated with that user.

Description / Descripción

password_verify(string $password, string $hash): bool

$password – password entered in an input field, typically by the user attempting to log in.

$hash – a hash created by password_hash, usually retrieved from the database.

Ejemplo de php.net

// See the password_hash() example to see where this came from.
$hash = '$2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1a';

if (password_verify('rasmuslerdorf', $hash)) {
    echo 'Password is valid!';
} else {
    echo 'Invalid password.';
}

Now, you may wonder, “How do I obtain the hash?”

The hash is obtained from the database. In reality, you should retrieve the data by the username, which should always be unique, or it could also be by their email, which should also be unique.

openssl_cipher_iv_length

https://blastcoding.com/en/data-encryption-in-php/#openssl_cipher_iv_length

Determines the length of the initialization vector for an encryption algorithm and mode.

Description / Descripción

openssl_cipher_iv_length(string $cipher_algo): int|false

$cipher_algo – algorithm we will use.

Returns

int – cipher length

false – in case of error

openssl_random_pseudo_bytes

https://blastcoding.com/en/data-encryption-in-php/#openssl_random_pseudo_bytes

Creates a pseudo-random string with the specified number of bytes.

Description / Descripción

openssl_random_pseudo_bytes(int $length, bool &$strong_result = null): string

$length – the desired length of the string

$strong_result (by reference)

openssl_encrypt

https://blastcoding.com/en/data-encryption-in-php/#openssl_encrypt

Encrypts the data, resulting in a string.

Description / Descripción

 
openssl_encrypt(
    string $data,
    string $cipher_algo,
    string $passphrase,
    int $options = 0,
    string $iv = "",
    string &$tag = null,
    string $aad = "",
    int $tag_length = 16
): string|false

This function has a large number of parameters, so we will look at those that are of interest for the demonstration of simple encryption that we want to perform.

$data – the data to be encrypted

$cipher_algo – the cipher algorithm we are using

$passphrase – encryption key

$iv – Initialization Vector (IV)

Ejemplo de encriptación con openssl_encrypt

$e_key = "EncryptionKey";//la llave de encripcion que deseas ponerle
$data = "Sensitive data";//datos a ser encriptados

$method = "aes-256-cbc";//algoritmo y opciones
$iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length($method));

// Encrypt the data
$encrypted_data = openssl_encrypt($data, $method, $e_key, 0, $iv);

echo $encrypted_data;//si hago un echo

Uos8EIOxD6DuuQXyhxTKoQ==

openssl_decrypt

https://blastcoding.com/en/data-encryption-in-php/#openssl_decrypt

decript the data

Description / Descripción

  
 openssl_decrypt(
    string $data,
    string $cipher_algo,
    string $passphrase,
    int $options = 0,
    string $iv = "",
    ?string $tag = null,
    string $aad = ""
): string|false

$data – in this case, $data will receive the encrypted data

We will also use: $cipher_algo, $passphrase, and $iv

Let’s see how they would be used. I have made this decryption example continue from what we saw in encryption, so $d_data will have the value "Sensitive data" (string).

$d_data = openssl_decrypt($encrypted_data, $method, $e_key, 0, $iv);

echo "\n Decrypted data: $d_data";

Decrypted data: Sensitive data