note 34990 deleted from function.serialize by didou

Note Submitter: sven@uebelacker.net ---- if you are looking for a way to store sensitive data in a hidden input field -- i.e. password/pin -- because you've further steps using this variables, try my solution: you got i.e. data from $_POST and put it in an array: $data=array("name"=>"Ford Prefect", "password"=>"microsoft sucks!", "timestamp"=>time(), //a timestamp is a good idea to //prevent crackers using cached files. ); and encrypt it: print "<input type=\"hidden\" name=\"sensitive\" value=\"".base64_encode(symm_crypt(serialize($data), "symmcrypt.key"))."\" />"; use this easy symmetric en/de-cryption function: function symm_crypt($value, $keyfile){ $key=""; //reading keyfile bytewise to get all chars (including \0 etc.) $fh=fopen($keyfile, "r"); while (!feof($fh)){ $key.=fgetc($fh); } fclose($fh); //fit strlen of $key to strlen of $value if (strlen($value) < strlen($key)){ //cut the key to strlen of $value $key=substr($key,0,(strlen($value))); } elseif (strlen($value) > strlen($key)){ // duplicate key & cut the key to strlen of $value $key=substr(str_repeat($key, 1+((int)(strlen($value) / strlen($key)))), 0, strlen($value)); } return($value ^ $key); //bitwise xor } for decryption, just take the $_POST['sensitive'] string and do it reverse: $data=unserialize(symm_crypt(base64_decode( $_POST['sensitive']), "symmcrypt.key")); for key generation I used a little perl script (sorry) which can be started every night etc. depends on how paranoid you are. :) #!/usr/bin/perl -w use IO::File; my $bytes=1024; my $outputfile="symmcrypt.key"; my $randomdevice="/dev/urandom"; my $line=""; my $fh=new IO::File($randomdevice) || die("Cannot open ".$randomdevice.".\n"); while(length($line)<$bytes) { $line.=<$fh>; } undef($fh); $line=substr($line, 0 , $bytes); $fh=new IO::File(">".$outputfile) || die("Cannot open ".$outputfile.".\n"); print $fh $line; undef($fh); suggestions are welcome, Sven Übelacker.