943,920 Members | Top Members by Rank

Web Development > ColdFusion > Decrypting an encrupted credit card number
Ad:
  • ColdFusion Discussion Thread
  • Unsolved
  • Views: 4704
  • ColdFusion RSS
You are currently viewing page 1 of this multi-page discussion thread
Permalink
Dec 15th, 2008
0

Decrypting an encrupted credit card number

Expand Post »
I'm tring to display an encrypted number store in sql database I have a key store in my application.cfm. and they number in my database is encrypted. My display code looks like this

ColdFusion Syntax (Toggle Plain Text)
  1. <cfloop query="Get_Orders">
  2. <cfoutput>
  3. <tr>
  4.  
  5. 	<td><div class="content_black">#Get_Orders.Credit_Card_Type#&nbsp;</div></td>
  6.  
  7.   <cfset key = #application.key#>
  8.   <cfset Cardnum = '#Get_Orders.Credit_Card_Number#'>
  9.   <cfset CardDec = decrypt(Cardnum, key)>
  10.  
  11.  
  12. 	<td><div class="content_black">#CardDec#&nbsp;</div></td>
  13. 	<td><div class="content_black">#Get_Orders.Credit_Card_Month#&nbsp;</div></td>
  14. 	<td><div class="content_black">#Get_Orders.Credit_Card_Year#&nbsp;</div></td>
  15. 	<td><div class="content_black">#Get_Orders.Credit_Card_Name#&nbsp;</div></td>
  16. 	<td><div class="content_black">#Get_Orders.Comments#&nbsp;</div></td>
  17. 	<td><textarea name="HL_Comments_#Get_Orders.Order_Estimate_ID#" cols="20" rows="5">#Get_Orders.HL_Comments#</textarea></td>
  18. 	<td align="center"><input type="Checkbox" name="Contacted_#Get_Orders.Order_Estimate_ID#" value="1"<cfif Get_Orders.Contacted IS 1> checked</cfif>></td>
  19. 	<td><div class="content_black">#Get_Orders.customerNumber#</div></td>
  20. 	<td><div class="content_black">#Get_Orders.billing_phone#</div></td>
  21. 	<td><div class="content_black">#Get_Orders.Billing_Email#&nbsp;</div></td>
  22. 	<td><div class="content_black">#DollarFormat(Get_Orders.invoiceAmt)#</div></td>
  23. 	<td align="center"><div class="content_black"><input type="Checkbox" name="Processed_#Get_Orders.Order_Estimate_ID#" value="1"<cfif Get_Orders.invoiceProcessed IS 1> checked</cfif>></div></td>
  24.  
  25.  </tr>
  26. </cfoutput>
  27. </cfloop>
Reputation Points: 12
Solved Threads: 36
Posting Pro in Training
freshfitz is offline Offline
436 posts
since Sep 2008
Permalink
Dec 15th, 2008
0

Re: Decrypting an encrupted credit card number

Well it turns out when every my encrypted string has a " in it when it gets store to my sql database it stops at the " . Is there any way to create the encryption string with no characters?
Reputation Points: 12
Solved Threads: 36
Posting Pro in Training
freshfitz is offline Offline
436 posts
since Sep 2008
Permalink
Dec 16th, 2008
0

Re: Decrypting an encrupted credit card number

Is that a double quote or two single quotes? What syntax are you using to insert the encrypted string into the database?

Side notes:

Since I don't work with cc's I am curious... is it a good idea to actually display the full credit card number on the web page?

Quote ...
<cfset key = #application.key#>
<cfset Cardnum = '#Get_Orders.Credit_Card_Number#'>
<cfset CardDec = decrypt(Cardnum, key)>
This has nothing to do with the problem, but there is no need for those # signs. Just use:

<cfset Cardnum = Get_Orders.Credit_Card_Number>
<cfset CardDec = decrypt(Cardnum, application.key)>
Reputation Points: 32
Solved Threads: 44
Posting Whiz
arrgh is offline Offline
349 posts
since Dec 2008
Permalink
Dec 16th, 2008
0

Re: Decrypting an encrupted credit card number

Here is the syntex

ColdFusion Syntax (Toggle Plain Text)
  1.  <cfset string = FORM.numCredit>
  2.                     <cfset key = ToBase64(BinaryDecode(#application.key#, "HEX"))>
  3.                     <cfset encrypted = encrypt(string, key)>

here is the encrypted string

0U5K" Z7*%U;#T,(/B?GX)0

it will only insert OU5K into the data base

Here is another
0U5[" ZG&$E/&T\8#BOC[(P

my sql table has
OU5[

I also tried

<cfset key = #application.key#>
<cfset Cardnum = '#Get_Orders.Credit_Card_Number#'>
<cfset CardDec = decrypt(Cardnum, key)>

and I still get " in my output


After I get this working thats my next task to trim the credit card being displayed on the page to the last 4 numbers
Last edited by freshfitz; Dec 16th, 2008 at 7:12 am.
Reputation Points: 12
Solved Threads: 36
Posting Pro in Training
freshfitz is offline Offline
436 posts
since Sep 2008
Permalink
Dec 16th, 2008
0

Re: Decrypting an encrupted credit card number

Click to Expand / Collapse  Quote originally posted by freshfitz ...
Here is the syntex
ColdFusion Syntax (Toggle Plain Text)
  1.  <cfset string = FORM.numCredit>
  2.                     <cfset key = ToBase64(BinaryDecode(#application.key#, "HEX"))>
  3.                     <cfset encrypted = encrypt(string, key)>
Are you using cfqueryparam when you insert the value into the database table?

ColdFusion Syntax (Toggle Plain Text)
  1. INSERT INTO YourTable ( EncryptedValue )
  2. VALUES 
  3. (
  4. <cfqueryparam value="#encrypted#" cfsqltype="( sql type for the column )">
  5. )
Reputation Points: 32
Solved Threads: 44
Posting Whiz
arrgh is offline Offline
349 posts
since Dec 2008
Permalink
Dec 17th, 2008
0

Re: Decrypting an encrupted credit card number

Here is my insert string

ColdFusion Syntax (Toggle Plain Text)
  1. <form action="payments_autopay.cfm" method="post">
  2. 				<input type="Hidden" name="action" value="confirm">
  3. 				<input type="Hidden" name="selCreditCard" value="#form.selCreditCard#">
  4. 				<input type="hidden" name="numCredit" value="#encrypted#">
  5. 				<input type="hidden" name="selExpMonth" value="#form.selExpMonth#">
  6. 				<input type="Hidden" name="selExpYear" value="#form.selExpYear#">
  7. 				<input type="Hidden" name="vcCreditName" value="#form.vcCreditName#">
  8. 				<input type="Hidden" name="customerNumber" value="#customerNumber#">
  9. 				<!--- <input type="Hidden" name="orderID" value="#findOrder.Order_Estimate_ID#">
  10.  --->
  11. 				<input type="Hidden" name="comments" value="#form.vccomments#">
  12. 				<input type="Hidden" name="email" value="#form.email#">
  13. 				<input type="hidden" name="bill_fname" value="#form.bill_vcfname#">
  14. 				<input type="hidden" name="bill_lname" value="#form.bill_vclname#">
  15. 				<input type="hidden" name="Bill_vcAddress1" value="#form.Bill_vcAddress1#">
  16. 				<input type="hidden" name="bill_vcCity" value="#form.bill_vcCity#">
  17. 				<input type="hidden" name="bill_vcST" value="#form.bill_vcST#">
  18. 				<input type="hidden" name="bill_numZip" value="#form.bill_numZip#">
  19. 				<input type="hidden" name="bill_phone" value="#form.bill_numPhone#">
  20. 				<tr>
  21. 				<td colspan="2">&nbsp;</td>
  22. 				</tr>
  23. 				<tr>
  24. 				<td>
  25. 				<a href="##" onclick="document.forms[0].submit()"><img src="images/button_confirmInfo.gif" width="132" height="18" alt="Confirm Information" title="Confirm Information" border="0"></a><br><br>
  26. 				<!-- <input type="Submit" name="submitBtn" value="Confirm">
  27.  -->
  28. 				</td>
  29. 				</tr>
  30. 				</form>
  31. 				</table>
  32. 				</cfoutput>
  33.  
  34. 			<!--- </CFIF>
  35.  --->
  36. 		<CFELSEIF isDefined("form.action") and form.action EQ "confirm">
  37. 				<cfquery name="findOrder" datasource="#request.dsn#">
  38. 					INSERT INTO HL_OrderEstimates(credit_card_type,credit_card_number,credit_card_month,credit_card_year,credit_card_name,invoiceProcessed,autopay,autopayDate, billing_fname,billing_lname,billing_address1, billing_city,billing_state,billing_zip, billing_phone, customerNumber)
  39. 					VALUES('#form.selCreditCard#','#form.numCredit#','#form.selExpMonth#','#form.selExpYear#','#form.vcCreditName#', 0, 1,getDate(),'#form.bill_fname#','#form.bill_lname#','#form.Bill_vcAddress1#','#form.bill_vcCity#', '#form.bill_vcST#', '#form.bill_numZip#', '#form.bill_phone#', '#customerNumber#')
  40. 				</cfquery>
Reputation Points: 12
Solved Threads: 36
Posting Pro in Training
freshfitz is offline Offline
436 posts
since Sep 2008
Permalink
Dec 17th, 2008
0

Re: Decrypting an encrupted credit card number

Try using cfqueryparam on all of the insert values. It works for me with MySQL.
Reputation Points: 32
Solved Threads: 44
Posting Whiz
arrgh is offline Offline
349 posts
since Dec 2008
Permalink
Dec 17th, 2008
1

Re: Decrypting an encrupted credit card number

Personally, I'd be worried by how readily reversible the encryption of valuable credit card details appears to be.
Team Colleague
Reputation Points: 5862
Solved Threads: 950
Posting Sage
Salem is offline Offline
7,164 posts
since Dec 2005
Permalink
Dec 18th, 2008
0

Re: Decrypting an encrupted credit card number

look my friend i had the same problem and i solved using this kind of encryption

coldfusion Syntax (Toggle Plain Text)
  1. <cfparam name="Request.PasswordKey" default="keyyyyyyyyyyyyyy">
  2.  <cfset Encrypted = Encrypt(form.number,  Request.PasswordKey)>
  3. <cfquery datasource="db">
  4. 		Insert Into table (field1, field2, ,field3)
  5. 		Values
  6.         (<cfqueryparam value="#form.na#">, <cfqueryparam value="#Encrypted#">)
  7.       	</cfquery>
  8. and when you want to decrypt the date
  9. use 
  10. <cfset decrypt = decrypt(fildes, Request.PasswordKey)>
hope it help
Thanks
Last edited by peter_budo; Dec 18th, 2008 at 3:19 pm. Reason: Keep It Organized - For easy readability, always wrap programming code within posts in [code] (code blocks) and [icode] (inline code) tags.
Reputation Points: 10
Solved Threads: 0
Newbie Poster
hhamdan is offline Offline
21 posts
since Nov 2008
Permalink
Dec 18th, 2008
0

Re: Decrypting an encrupted credit card number

Click to Expand / Collapse  Quote originally posted by hhamdan ...
look my friend i had the same problem and i solved using this kind of encryption
Encryption was not the problem. It was the lack of cfqueryparam, as I already mentioned.

Though, I agree with Salem about security. If you are storing credit card information security and encryption should be very tight. If you are not well versed in it or don't have the experience and resources, there are reputable companies that do. Consider the liability if security is poor ..
Reputation Points: 32
Solved Threads: 44
Posting Whiz
arrgh is offline Offline
349 posts
since Dec 2008

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in ColdFusion Forum Timeline: Please Help
Next Thread in ColdFusion Forum Timeline: Authenticate cfmail with exchange





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC