Re: Re: Encrypted field

On Fri, 10 Dec 2004 12:38:54 +0100, Rodrigo Alvarez <papipo@gmail.com> wrote: > Rodrigo Alvarez wrote: > > > > Hi PEARs, > > > > I'm using formbuilder and as showed in wiki example I must encrypt some > > data in database. But I'cant use md5 because data must be recoverable. > > > > Which type of encryption should I use? I can use MySQL functions, php > > functions or any external clases (RSA or something). > > > > And, how would you do this? Is the example at the wiki the unique way? I > > have a lot of entities and I it could ble clearer to use some kind of > > function, instead of copy-paste-modify. > > > > Thank U, > > > > Rodrigo. > > I'm using this in all my create-update forms, as you can see, for > language purposes: > > class DB_DataObject_MyFormBuilder extends DB_DataObject_FormBuilder { That should be DB_DataObject_FormBuilder_QuickForm. Also, make sure you're requiring DB/DataObject/FormBuilder/QuickForm.php > > function &create(&$do) > { > $fb = &parent::create($do); > $fb->ruleViolationMessage = 'El valor introducido no es válido.'; > $fb->requiredRuleMessage = 'El campo %s es obligatorio.'; > return $fb; > } > } > > Can I implement some methods here to filter fields marked as encrypted > in my DAOs, for example: > > class DAO_Addon extends DB_DataObject > { > ###START_AUTOCODE > /* the code below is auto generated do not remove the above tag */ > > /* the code above is auto generated do not remove the tag below */ > ###END_AUTOCODE > > var $fb_encryptedFields = array('price'); > } > > So DB_DataObject_MyFormBuilder encrypts and decrypts all > $fb_encryptedFields? > Sure you can. You could override the generateForm method to decrypt the data before sending to the user, then override processForm to encrypt it before it goes to the DB. *or* you could create your own DO class which your DO extends. Override the fetch()/insert()/update() methods to deal with the encrypted fields. This is the method I chose for file handling and encryption. BTW, why are you storing encrypted in the DB, then sending unencrypted to the user's browser? If the web connection isn't ovet HTTPS you're just putting it out there for stealing in another place. -- Justin Patrin