What is a current best practice example of basic encryption and decryption in PHP?

Question

I have a good working knowledge of basic security best practices (password hashing, preventing sql injection, CSRF, etc.) but am completely at a loss for finding a solution to common-case encryption and decryption in PHP.

Google is little help, with most results being heavily-criticised for being insecure by design or simply out-dated (e.g. EBC) and to add to the confusion, the plethora of libraries seems to offer little confidence over each other.

Say I have a string of plaintext and a key that will not change and I want to be able to encrypt and decrypt that string at will using that key with as little code as possible (ideally a one-liner) and while adhering to current best practice. Could someone please provide an example of this in PHP?

A great example of where this would be useful is when storing sensitive data in WordPress. The Options API makes basic storage and retrieval really easy, but often you need to store credit card details, API keys, etc. and a really simple one-liner would greatly improve the situation.

Also, if I'm asking in the wrong place and there already exists an always-up-to-date source for this exact problem, please feel free to direct me there.

EDIT: The key should support an arbitrary string, so you could use WordPress's AUTH_KEY if desired and to keep it simple.

Answer 1

I don't think there is any one line function or method for encryption and decryption. You can try this, its pretty easy

https://github.com/CoreProc/crypto-guard

Sample:

<?php

require 'vendor/autoload.php';

use Coreproc\CryptoGuard\CryptoGuard;

// This passphrase should be consistent and will be used as your key to encrypt/decrypt
// your string

$passphrase = 'whatever-you-want';

// Instantiate the CryptoGuard class

$cryptoGuard = new CryptoGuard($passphrase);

$stringToEncrypt = 'test';

// This will spit out the encrypted text

$encryptedText = $cryptoGuard->encrypt($stringToEncrypt);

// This should give you back the string you encrypted

echo $cryptoGuard->decrypt($encryptedText);

Answer 2

Seems that what I'm hoping for doesn't exist. I'd love to see something like this in PHP core because most people just don't have the time, interest or inclination to learn things like this but will still inevitably need it.

I ended up using a library. https://github.com/defuse/php-encryption looked very good, but not available on Packagist, so I went with http://phpseclib.sourceforge.net/