What do you think it's the best method to secure a string in PHP? I speak of hiding its content and avoid malicious changes by the user, but be able to recover the information.

We can use the open_ssl functions, but I prefer using a simpler solution, more platform-compatible, quicker, and without the need of public/private keys.

For example, it can be useful for creating a custom URL that will be accessed with other device, like a QR code shown on a webpage that has to be scanned with iOS's Passbook or similar apps.

I think that this can be accomplished using some obfuscation method (like char replacement using a dictionary), and a trailing hash to ensure the data integrity, but I would like to hear your opinions.

Thank you

closed as unclear what you're asking by Eric G, TildalWave, Xander, Adi, Rory Alsop Mar 21 '14 at 14:40

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 7
    Ever heard of sessions? – Lucas Kauffman Mar 21 '14 at 10:21
  • I agree with @LucasKauffman - Don't reinvent the wheel. Sessions are wonderful for dynamic information. Are you trying to secure static text, written into your code? – Mat Carlson Mar 21 '14 at 10:59
  • I've edited my question with an example where sessions cannot be used – Javier Marín Mar 24 '14 at 10:06

Like Lucas Kauffman said: Please use sessions for this. Everything stored in the $_SESSION array is neither sent nor visible to the user.

  • I've edited my question with an example where sessions cannot be used – Javier Marín Mar 24 '14 at 10:05
  • What you want may be an HMAC with a timestamp? – freddyb Mar 24 '15 at 16:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.