note 107233 added to function.mcrypt-encrypt

Note for security reasons, do not use this code unmodified (meaning, don't just set the methods, modes and hash strings). I suggest to anyone using this to shake things up themselves. Put information in different places, put the initialization vector somewhere other than tacked on at the front, (maybe after the 4th or 10th character), use a different separator, and/or even add garbage to the string (just know how to pull it out later). Also, avoid encrypting labels for the information, i.e. don't encrypt "username=someuser|password=somepass" as this can make brute force attacks easier. Instead, do something like "someuser|somepass". BTW--By converting the initialization vector to hex before inserting the it, you effectively camouflage it in the encrypted text. Finally, watch out for repeated attacks, include an encrypted datetime value to check against. If the datetime is within a reasonable period, then honor the request. (Also, be vague with error messages displayed to the user, but verbose stored error messages. Give those hackers heck!) ---- Server IP: 69.147.83.197 Probable Submitter: 162.39.212.101 ---- Manual Page -- http://www.php.net/manual/en/function.mcrypt-encrypt.php Edit -- https://master.php.net/note/edit/107233 Del: integrated -- https://master.php.net/note/delete/107233/integrated Del: useless -- https://master.php.net/note/delete/107233/useless Del: bad code -- https://master.php.net/note/delete/107233/bad+code Del: spam -- https://master.php.net/note/delete/107233/spam Del: non-english -- https://master.php.net/note/delete/107233/non-english Del: in docs -- https://master.php.net/note/delete/107233/in+docs Del: other reasons-- https://master.php.net/note/delete/107233 Reject -- https://master.php.net/note/reject/107233 Search -- https://master.php.net/manage/user-notes.php