Member Avatar for accra

Hi, am currently using this script to protect/encrpty info in the address bar,but i thnk its not very strong. cn any one help me make/find a more secure one, thanks.

<a href='articlesdetails.php?pif=ixhsuwu9xyysysjj300&yisu=uuwuwuwzuab&jsn=733888559jdjdjdeyey&tsyi=378hyxbh738hssh272sh&zy9stxyw=w&shy272bs2637shuw727hhshs377ywwwyw&id=$id'>
  • 3 Contributors
  • 6 Replies
  • 198 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by mschroeder

Dani AI

Generated

Short answer: hiding or “encrypting” the part of the URL is mostly cosmetic; real protection belongs on the server. ’s example (Facebook-style tid values) is common, but anything sent in the URL appears in browser history, logs and Referer headers, so it must never carry secrets or be treated as trusted input. (owasp-aasvs.readthedocs.io)

For the look-and-feel goal (remove visible filenames like books.php) use URL rewriting / a front controller so friendly paths map internally to your scripts, as suggested. That solves aesthetics and SEO but does not stop access. To actually restrict pages use server-side session/auth checks or an access-control layer, as pointed out — sessions are the correct control point. (httpd.apache.org)

If some state must travel in a link (short-lived deep links, one-time tokens, tracking IDs), prefer a signed or standard token rather than simple obfuscation. Use HMAC-signed strings or a JWT/JWS with an expiry so the server can detect tampering and expiration; encode tokens with URL-safe base64 (base64url). Do not rely on home-grown reversible “hashes” for security — use vetted primitives and verify everything server-side. (php.net)

Implementation cautions and quick checklist: do not use the old mcrypt extension (it’s deprecated); use libsodium or OpenSSL with an AEAD cipher (AES‑GCM or ChaCha20‑Poly1305), include a fresh nonce/IV and long secret keys, and always validate tokens on the server. In short — hide filenames with rewrites for appearance, protect resources with sessions/authorization for access control, and only put signed/time-limited tokens in URLs when absolutely needed. (php.net)

Recommended Answers

All 6 Replies

Member Avatar for mschroeder

What is the reasoning for encrypting/protecting what is in the url? Considering this is supplied/visible/modifiable by the user it should never be treated as trusted data and should always be filtered/validated before you use it in your application.

Member Avatar for Member #120589

what's this at the end? id=$id

Look, you've created the hashes/encryptions - you must have had a reason. What are you trying to do?

Member Avatar for accra

what's this at the end? id=$id

Look, you've created the hashes/encryption - you must have had a reason. What are you trying to do?

for example, i have a site under construction. www.example.com/
all am trying to do is encrypt any thing that comes after the slash '/' ,example: . i don't what the 'books.php' showing in words, i want to encrypt it,that's all.

Thanks for your concern and time.

Edited by Ezzaral because: Change to generic link. Don't post personal links unless absolutely necessary for the question.
Member Avatar for Member #120589

I have to be honest, I don't see why you need to go to all the trouble of doing that. Why is books.php so secret? Your 'allowed' pages can be protected with something like sessions.

Member Avatar for mschroeder

While I don't understand your use case, and I think you're encrypting the url parameters for no value, you could do this with mod_rewrite.

However you would need some kind of indicator to tell it where to route the url params to.

e.g.
website.com/books/{encrypted} and your rewrite rules would rewrite this to website.com/books.php?enc={encrypted}

The encrypted text would be best represented by base64_encode( mcrypt_encrypt( http_build_query( $array ) ) );

Your script would then receive this string via the $_GET variable and you would need to decode it, unecrypt it, and then parse the query back into attribute value pairs.

Also if you choose this route be aware you will need to use a URI-safe base64_encode as + / and = are not uri safe.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.