Re: Re: Encrypted field

On Fri, 10 Dec 2004 20:00:01 +0100, Rodrigo Alvarez <papipo@gmail.com> wrote: > Justin Patrin wrote: > > > > On Fri, 10 Dec 2004 12:38:54 +0100, Rodrigo Alvarez <papipo@gmail.com> wrote: > > > >>Rodrigo Alvarez wrote: > >> > >> > >> > >>>Hi PEARs, > >>> > >>>I'm using formbuilder and as showed in wiki example I must encrypt some > >>>data in database. But I'cant use md5 because data must be recoverable. > >>> > >>>Which type of encryption should I use? I can use MySQL functions, php > >>>functions or any external clases (RSA or something). > >>> > >>>And, how would you do this? Is the example at the wiki the unique way? I > >>>have a lot of entities and I it could ble clearer to use some kind of > >>>function, instead of copy-paste-modify. > >>> > >>>Thank U, > >>> > >>>Rodrigo. > >> > >>I'm using this in all my create-update forms, as you can see, for > >>language purposes: > >> > >>class DB_DataObject_MyFormBuilder extends DB_DataObject_FormBuilder { > > > > > > That should be DB_DataObject_FormBuilder_QuickForm. Also, make sure > > you're requiring DB/DataObject/FormBuilder/QuickForm.php > > > > > >> function &create(&$do) > >> { > >> $fb = &parent::create($do); > >> $fb->ruleViolationMessage = 'El valor introducido no es > >> válido.'; > >> $fb->requiredRuleMessage = 'El campo %s es obligatorio.'; > >> return $fb; > >> } > >>} > >> > >>Can I implement some methods here to filter fields marked as encrypted > >>in my DAOs, for example: > >> > >>class DAO_Addon extends DB_DataObject > >>{ > >> ###START_AUTOCODE > >> /* the code below is auto generated do not remove the above tag */ > >> > >> /* the code above is auto generated do not remove the tag below */ > >> ###END_AUTOCODE > >> > >> var $fb_encryptedFields = array('price'); > >>} > >> > >>So DB_DataObject_MyFormBuilder encrypts and decrypts all > >>$fb_encryptedFields? > >> > > > > > > Sure you can. You could override the generateForm method to decrypt > > the data before sending to the user, then override processForm to > > encrypt it before it goes to the DB. > Ok, I will go this way. > > > > *or* you could create your own DO class which your DO extends. > > Override the fetch()/insert()/update() methods to deal with the > > encrypted fields. This is the method I chose for file handling and > > encryption. > This should be applied for each DO, and I have at least 20 different > entities. Since I'm using My own form builder, I won't use this method, > so I can modify in one single point. > > > > > > BTW, why are you storing encrypted in the DB, then sending unencrypted > > to the user's browser? If the web connection isn't ovet HTTPS you're > > just putting it out there for stealing in another place. > > > The connection is over https. This is for an application for my job that > is secured everywhere. > > Thank you, Justin ;] > No problem. It's great to have people using code I've written. :-) -- Justin Patrin