[PHP] mcrypt 2.4.x - trouble with small data fields?
On my current project I am saving personal info into a MySQL database
for later retrieval. I have discovered that I have trouble with a few
specific data entries, though the other ~20 work fine. The two I have
trouble with are a char(2) and a varchar(4) field, the smallest ones in the
table, and they return garbage when decrypted. Is there a minimum field
size for using mcrypt? Sample code:
// to encrypt, init once
$mykey = 'keytext';
$td = mcrypt_module_open(MCRYPT_TRIPLEDES,'', MCRYPT_MODE_ECB, '');
$iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), 1234567890);
$ks = mcrypt_enc_get_key_size ($td);
$key = substr(md5($mykey), 0, $ks);
mcrypt_generic_init($td, $key, $iv);
(...)
$CreditCardExpMonth = mcrypt_generic($td, $_POST['Credit_Card_Exp_Month']);
(...)
// then save to database as part of insert query
If I save/retrieve the fields to/from the database w/o encryption they
save & retrieve fine. This field is two digits ('02', '11', etc.). The
other is the year (4 digits).
// to decrypt
// I wrote a function to truncate the returned string at the
// first \0 since mcrypt's decrypt pads the result
echo mydecrypt($data['CCExpMonth']);
function mydecrypt($enc) {
global $td;
$str = mdecrypt_generic($td, $enc);
$pos = strpos($str, "\0");
if ($pos !== false) {
$str = substr($str, 0, $pos);
}
return $str;
}
Also as long as I'm posting, mcrypt_generic_deinit() seems to be
undefined on my system? Is that an mcrypt issue or an interaction between
PHP 4.1.2 and mcrypt 2.4.x?
- Steve Yates
- Do trees moving back and forth make the wind blow?
~ Taglines by Taglinator - www.srtware.com ~
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: Prevent storing data when reload
"Lars Espelid" <[EMAIL PROTECTED]> wrote in message
[EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
> When I reload the page the data gets stored once more.
if (record already exists) {
echo "hey you hit reload!"
} else {
[save record to database]
}
- Steve Yates
- I know a good tagline when I steal one.
~ Taglines by Taglinator - www.srtware.com ~
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: mcrypt 2.4.x - trouble with small data fields?
>Is there a minimum field size for using mcrypt? Boy I feel dumb now. :) My answer was in my post. Mcrypt returns a string that is usually longer than the original string, since the return has to be a multiple of the block size used. So a 2-character string takes "blocksize" characters when encrypted. Mcrypt also apparently needs the extra characters when decrypting. - Steve Yates - If at first you don't succeed, lower your standards. ~ Taglines by Taglinator - www.srtware.com ~ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP] 2 dates, difference in days AARGH!!
"Curtis Gordon" <[EMAIL PROTECTED]> wrote in message
[EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
>
>
Why not use $now_date = mktime(0,0,0,date('m'),date('d'),date('Y')); ?
Also, do you really use on each line? Wouldn't that just slow down
processing as PHP jumps in & out of "code mode?"
- Steve Yates
- When you do a good deed get a receipt, in case heaven is like the IRS.
~ Taglines by Taglinator - www.srtware.com ~
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP] Smarty + css + dreamweaver
"Olinux" <[EMAIL PROTECTED]> wrote in message > > problem here. But ... since scriptsN.php need the > > So the browser shouldnt find the style sheet because > > TemplatesN.html > > call ../style.css and ../style.css doesnt exists > > relative to > > http://site/scriptN.php , and for my surprise the > > output result DOES > > apply the style sheet When Dreamweaver applies (or reapplies) a template to a page it will fix any relative links to work for the target page, regardless of where it is in the hierarchy. If you look closely at /scriptN.php I am sure the template's link is not to "../style.css". - Steve Yates - Remember, you're unique. Just like everybody else. ~ Taglines by Taglinator - www.srtware.com ~ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: Mail() Not working right
"Tom Culpepper" <[EMAIL PROTECTED]> wrote in message
[EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
> while I get no PHP errors the mail is never sent.
> mail("[EMAIL PROTECTED]", "testing 1234", "this is a test message");
I don't think this shows an error if it doesn't work. Try
$mailsuccess = mail(...);
if (!$mailsuccess) {
echo "oops";
}
- Steve Yates
- How often should we practice sex before it is safe?
~ Taglines by Taglinator - www.srtware.com ~
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: real time output
"Art Chevalier" <[EMAIL PROTECTED]> wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > I want to start a native process and capture the output while it is being > generated and display it to the screen. I dont want to output to be > displayed on the screen all at once after the process completes. http://www.php.net/manual/en/ref.outcontrol.php However note the section in flush() that says, "Note: flush() has no effect on the buffering scheme of your webserver or the browser on the client side. Several servers, especially on Win32, will still buffer the output from your script until it terminates before transmitting the results to the browser." This was my issue with using this capability of PHP...it didn't seem to work, like Perl's "$| = 1;" did on the same server (Unix Apache). The server's config has the output_buffering INI setting set to "no value". Seems odd since I got the Perl script to not buffer, which would imply it's not a browser issue. - Steve Yates - A fool and his money are soon popular. ~ Taglines by Taglinator - www.srtware.com ~ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: fgets() question?
"Noel Wade" <[EMAIL PROTECTED]> wrote in message
[EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
> When you use $foo = fgets($fp_file); it appears that a blank line ends up
> looking exactly like a FALSE ("failed to read") return value...
A blank line should return the newline (\n or \r\n), according to
http://www.php.net/manual/en/function.fgets.php. Also try using '===' (3 =
signs) as the operator, which enforces type checking on a comparison).
- Steve Yates
- If you only have a nail every tool looks like a hammer.
~ Taglines by Taglinator - www.srtware.com ~
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] occasional mcrypt problems
Hello,
I recently implemented a database using MySQL that is storing selected
fields encrypted. However on a very small number of records the decrypted
result is not correct for some fields, for example for this credit card
number:
-99-ÏF¡hßxø
It appears in fact the same way as the problem I first experienced, when the
database field was not big enough to store the encrypted text (which I
discovered takes a multiple of the blocksize, so it is usually bigger than
the original string). However the blocksize is 8 and to provide a safety
margin all the fields to be encrypted have 10 extra characters in them
(varchar fields).
So far this happens on at most one field in a record, perhaps on less than
5% of the records. At first I was thinking maybe the addslashes() was
adding text but MySQL should be stripping that out before entering it into
the database, right? Also I can't seem to duplicate this by entering the
same values in the form again.
Any suggestions? Here is my encryption code:
$hrkey = '$R^a$nd()M%'; // changed text
$td = mcrypt_module_open(MCRYPT_TRIPLEDES,'', MCRYPT_MODE_ECB, '');
$iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), 99);
//changed the number
$ks = mcrypt_enc_get_key_size ($td);
$key = substr(md5($hrkey), 0, $ks);
mcrypt_generic_init($td, $key, $iv);
$CreditCardNumber = addslashes(mcrypt_generic($td,
$_POST['Credit_Card_Number']));
(...post to database here...)
mcrypt_module_close($td);
Decryption code:
function mydecrypt($enc) {
global $td;
return rtrim(mdecrypt_generic($td, $enc), "\0");
}
Thanks for any insight!
- Steve Yates
- ASCII stupid question, get a stupid ANSI.
~ Taglines by Taglinator - www.srtware.com ~
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP] occasional mcrypt problems
"Marek Kilimajer" <[EMAIL PROTECTED]> wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > try > $_POST['Credit_Card_Number']=stripslashes($_POST['Credit_Card_Number']); But if magic_quotes_gpc=on shouldn't that happen automatically? - Steve Yates - Brainstorm? No, but I had a braindrizzle once. ~ Taglines by Taglinator - www.srtware.com ~ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP] occasional mcrypt problems
"Marek Kilimajer" <[EMAIL PROTECTED]> wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > As you have magic_quotes on, automatically happens *addslashes*, now you > need to reverse the proces I think I see where you're going, but I'm not sure that's the correct avenue here. If slashes from magic_quotes were in the string before encryption, wouldn't they be in the string after decryption? Why would that result in data corruption? > >"Marek Kilimajer" <[EMAIL PROTECTED]> wrote in message > >[EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > >>$_POST['Credit_Card_Number']=stripslashes($_POST['Credit_Card_Number']); - Steve Yates - WORK HARDER!... Millions on welfare depend on YOU!!! ~ Taglines by Taglinator - www.srtware.com ~ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: occasional mcrypt problems
"J Smith" <[EMAIL PROTECTED]> wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > Try using a different block cipher mode. When encrypting with ECB, as you > said, your plaintext must have a length that is a multiple of the blocksize Are you sure? I read the manual the other way...that the *result* is a multiple of blocksize: "This function encrypts data. The data is padded with "\0" to make sure the length of the data is n * blocksize. This function returns the encrypted data. Note that the length of the returned string can in fact be longer then the input, due to the padding of the data." I am storing the encrypted, padded string. > If it's anything less, you're going to get some garbage at > the end of the decrypted ciphertext. This would imply that any non-blocksize-length strings would be corrupted which is not the case. 99% are fine. > require that you store the IV for each encryption along with the > ciphertext, but that's fine, as storing the IV along with the ciphertext is > not a security problem. However changing now will mean handling some historical data differently somehow. :( And storing an IV for each record would of course increase the data size. - Steve Yates - #include ~ Taglines by Taglinator - www.srtware.com ~ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: occasional mcrypt problems
After much testing, I think I may have it. It appears that MySQL is dropping a trailing space from the value being inserted into the database! For example if the encrypted string is " (.A®¢m¸"¼'À " MySQL stores the value without the trailing space (and it is a space). Why is that? I can duplicate this by entering "test " as the field value too. - Steve Yates - Life would be easy if we had the source code. ~ Taglines by Taglinator - www.srtware.com ~ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: occasional mcrypt problems
"Steve Yates" <[EMAIL PROTECTED]> wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > After much testing, I think I may have it. It appears that MySQL is > dropping a trailing space from the value being inserted into the database! > For example if the encrypted string is " (.A®¢m¸"¼'À " MySQL stores the > value without the trailing space (and it is a space). Why is that? As with many "bugs" it's because I told it to! To my surprise, MySQL varchar fields have their trailing spaces removed on insertion. Tinyblob or Tinytext fields do not, so one needs to use those (or their larger brethren) when saving encrypted or binary data to MySQL. Thanks to those who tried to help! - Steve Yates - Computers make very fast, very accurate mistakes. ~ Taglines by Taglinator - www.srtware.com ~ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Zend Optimizer not active?
Starting with a working site (FreeBSD 4.7, Apache 1.3.27) using PHP 4.3.0 and the latest Zend Optimizer, I upraded to PHP 4.3.2. Afterwards, phpinfo () did not show the Optimizer as loaded. Reinstalling Optimizer did not change this, nor did uninstalling and reinstalling Optimizer. There were no errors during the Optimizer install, and everything looks like it's correct to me...the two lines are in php.ini, and they point to the right ZendOptimizer.so file. There is only one php.ini on the system. Any hints? Thanks, - Steve Yates - Termite in pub: "Is the bar tender here?" ~ Taglines by Taglinator - www.srtware.com ~ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: Zend Optimizer not active?
On Fri, 13 Jun 2003 10:38:39 +0200, Marek Kilimajer wrote: >Are the logs saying anything? Or if you run php from command line? Sorry should have made that clear. Apache's error log does not show any reference to PHP or Zend, nor does /var/log/messages. Is there another place I should look? >From php.ini: [Zend] zend_optimizer.optimization_level=15 zend_extension=/usr/local/Zend/lib/ZendOptimizer.so /usr/local/Zend/lib# ls ZendOptimizer.so /usr/local/bin# php -version PHP 4.3.2 (cli) (built: Jun 10 2003 13:51:42) Copyright (c) 1997-2003 The PHP Group Zend Engine v1.3.0, Copyright (c) 1998-2003 Zend Technologies Running the CLI on a phpinfo() call also does not show Optimizer. Also phpinfo() says "Debug Build => no" so that's not it. - Steve Yates - I have 5 nanosecond memory. Duration - not access time. ~ Taglines by Taglinator - www.srtware.com ~ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: Zend Optimizer not active?
Ah, how clear things are afterwards. :) I found out my problem was that PHP was looking in the "wrong" folder for php.ini, and it apparently fails silently, taking the default settings instead. - Steve Yates - A chicken is just an egg's way of continuing the species. ~ Taglines by Taglinator - www.srtware.com ~ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP] turn register_globals on
> Anup wrote: > > Hello I am working on a PHP server which has register_globals off. In my > > script is there anyway to turn it on, just for my script? One trick for using old PHP code is to use extract($HTTP_POST_VARS); ...at the beginning of your script. That will autocreate all the POST variables for you. Works for GET and others, too. - Steve Yates - Psychology: the study of the id by the odd. ~ Do you like my taglines? Add them to your messages and ~ laugh through hundreds more by downloading Taglinator ~ at www.srtware.com today! -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: HTTP_SERVER_VARS not working. Please help
"Cirstoiu Aurel Sorin" <[EMAIL PROTECTED]> wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > I tried to use $HTTP_SERVER_VARS['HTTP_HOST'] but the result is null. I believe your web server has to set that variable. Does phpinfo() show a value for it? - Steve Yates - Friends don't let friends drive naked. ~ Do you like my taglines? Add them to your messages and ~ laugh through hundreds more by downloading Taglinator ~ at www.srtware.com today! -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: .php to .html?
"Jean-Christian Imbeault" <[EMAIL PROTECTED]> wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > How can I make my pages come out as .html instead of .php? Rename your pages to .html, and configure Apache to send all .html pages through PHP: -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: .php to .html?
"Steve Yates" <[EMAIL PROTECTED]> wrote in message news:... > "Jean-Christian Imbeault" <[EMAIL PROTECTED]> wrote in message > [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > > How can I make my pages come out as .html instead of .php? > > Rename your pages to .html, and configure Apache to send all .html pages > through PHP: Sorry, hit the wrong button. My example was to add this to httpd.conf: AddType application/x-httpd-php .html Note that this will parse every page, so is inefficient if you have many plain .html files (no PHP code). - Steve Yates - (A)bort, (R)etry, (T)oss computer across room? ~ Do you like my taglines? Add them to your messages and ~ laugh through hundreds more by downloading Taglinator ~ at www.srtware.com today! -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP] PHP 4.2.2 vs PHP 4.0.6
> From: Alex Shi [mailto:[EMAIL PROTECTED]] > 1. why PHP changed the way to access submitted vars; Because if you use a hidden variable like $validuser='yes' inside your script you probably forgot to check whether the user did this: www.eol.ca/page.php?validuser=yes > 2. any good suggestion to avoid this problem, such as that is it possible > to configure 4.2.2 to compatible downward. extract($HTTP_POST_VARS) will create all variables from that array. - Steve Yates - An unbreakable toy is only useful for breaking other toys. ~ Do you like my taglines? Add them to your messages and ~ laugh through hundreds more by downloading Taglinator ~ at www.srtware.com today! -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP] register_global variables on Mac OS X
> From: Jule Slootbeek [mailto:[EMAIL PROTECTED]] > register_globals to on, so i don't have to go through 15 pages of code > and change all my variables to $_POST['foo'] Try extract($HTTP_POST_VARS) which will create $foo for you. - Steve Yates - Your karma just ran over my dogma. ~ Do you like my taglines? Add them to your messages and ~ laugh through hundreds more by downloading Taglinator ~ at www.srtware.com today! -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP] Re: Undefined variable
"Muhammad Khairuzzaman" <[EMAIL PROTECTED]> wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > I worked, but i dont get it, why use $_POST['name'] or $_GET['name'] when If you set a variable inside your script called $validuser=true, how would you know if that was POSTed to your script or I added secretpage.php?validuser=true to the URL? Bet you wouldn't have checked... - Steve Yates - Can taglines have sequels? Hmmm. ~ Do you like my taglines? Add them to your messages and ~ laugh through hundreds more by downloading Taglinator ~ at www.srtware.com today! -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP] PHP with online cedit card processing
> > names of companies that charge a reasonable rate, that you can use you own > > shopping cart and work well with PHP My company's site uses Innuity as a gateway with PHP pages. You can do whatever you want to get the totals, then POST the charge to their secure server which can return all values back to a script on your site to finish. Pretty well documented too. We use it for web site hosting and domain name registration orders. http://www.teamITS.com/internet/credit_cards.html - Steve Yates - A Penny saved is a congressional oversight. / Taglines by Taglinator - www.srtware.com / -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP] securing an 'includes' dir
"Justin French" <[EMAIL PROTECTED]> wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > 1. Name all included files .inc If you name them *.php then put anything in them inside a function, then when the user browses to that file he/she won't see anything at all. - Steve Yates - A fool and his money... Hey! Where's my wallet? / Taglines by Taglinator - www.srtware.com / -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP] securing an 'includes' dir
"Chris Shiflett" <[EMAIL PROTECTED]> wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > Steve Yates wrote: > >If you name them *.php then put anything in them inside a function, then > >when the user browses to that file he/she won't see anything at all. > > > I think this is a very poor tactic, because it "covers up" the problem > rather than doing anything about it. >(...) > It's much better to properly name your included files *.inc as suggested > by Mr. French and either: > 1. don't put them under document root (my preference) > or: > 2. configure your Web server to not allow access to .inc files I guess I wasn't trying to say that my suggestion was a complete solution, but one thing to consider. For instance, what happens if the .htaccess file is accidentally deleted? Then there's no protection. Or say the host upgrades PHP or Apache and for whatever reason PHP files aren't being parsed? Then my suggestion doesn't solve things (but moving them outside the htdocs structure will, if available as an option). Is there an advantage to not putting code in included files inside functions? I wasn't sure if you were critiquing that part of my suggestion also. - Steve Yates - Edit. Assemble. Link. Run. Curse. Boot. / Taglines by Taglinator - www.srtware.com / -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP] DOCUMENT_ROOT disappeared on me!
"David E. Weekly" <[EMAIL PROTECTED]> wrote in message 000701c221d7$656f8d90$[EMAIL PROTECTED]">news:000701c221d7$656f8d90$[EMAIL PROTECTED]... > I had to retool all of my scripts. =/ This is probably too late but one can use extract($_POST) or similar at the beginning of a script to create those variables. I presume $_SERVER works as well. - Steve Yates - Peace. (subject to change without notice) / Taglines by Taglinator - www.srtware.com / -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
