Re: Re: Encrypted field

Justin Patrin wrote:

On Fri, 10 Dec 2004 12:38:54 +0100, Rodrigo Alvarez <papipo@gmail.com> wrote:

Rodrigo Alvarez wrote:

Hi PEARs, I'm using formbuilder and as showed in wiki example I must encrypt some data in database. But I'cant use md5 because data must be recoverable. Which type of encryption should I use? I can use MySQL functions, php functions or any external clases (RSA or something). And, how would you do this? Is the example at the wiki the unique way? I have a lot of entities and I it could ble clearer to use some kind of function, instead of copy-paste-modify. Thank U, Rodrigo.

I'm using this in all my create-update forms, as you can see, for language purposes: class DB_DataObject_MyFormBuilder extends DB_DataObject_FormBuilder {

That should be DB_DataObject_FormBuilder_QuickForm. Also, make sure you're requiring DB/DataObject/FormBuilder/QuickForm.php

       function &create(&$do)
       {
               $fb = &parent::create($do);
               $fb->ruleViolationMessage = 'El valor introducido no es válido.';
               $fb->requiredRuleMessage = 'El campo %s es obligatorio.';
               return $fb;
       }

} Can I implement some methods here to filter fields marked as encrypted in my DAOs, for example: class DAO_Addon extends DB_DataObject {

    ###START_AUTOCODE
    /* the code below is auto generated do not remove the above tag */

    /* the code above is auto generated do not remove the tag below */
    ###END_AUTOCODE

    var $fb_encryptedFields = array('price');

} So DB_DataObject_MyFormBuilder encrypts and decrypts all $fb_encryptedFields?

Sure you can. You could override the generateForm method to decrypt the data before sending to the user, then override processForm to encrypt it before it goes to the DB. Ok, I will go this way.

*or* you could create your own DO class which your DO extends. Override the fetch()/insert()/update() methods to deal with the encrypted fields. This is the method I chose for file handling and encryption. This should be applied for each DO, and I have at least 20 different entities. Since I'm using My own form builder, I won't use this method, so I can modify in one single point.

BTW, why are you storing encrypted in the DB, then sending unencrypted to the user's browser? If the web connection isn't ovet HTTPS you're just putting it out there for stealing in another place. The connection is over https. This is for an application for my job that is secured everywhere.

Thank you, Justin ;]