I want to build a php application which I can store my patients informations. I found two functions on internet. One for encrypt and one for decrypt but I'm facing some problem.
This is an example. I need to store tones of informations with this way. I need to know if this will slow my app.
function encryptthis($data, $key) {
$encryption_key = base64_decode($key);
$iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length('aes-256-cbc'));
$encrypted = openssl_encrypt($data, 'aes-256-cbc', $encryption_key, 0, $iv);
return base64_encode($encrypted . '::' . $iv);
}
function decryptthis($data, $key) {
$encryption_key = base64_decode($key);
list($encrypted_data, $iv) = array_pad(explode('::', base64_decode($data), 2),2,null);
return openssl_decrypt($encrypted_data, 'aes-256-cbc', $encryption_key, 0, $iv);
}
if(isset($_POST['login'])){
$username = $_POST['username'];
$password = $_POST['password'];
$usrEncr = encryptthis($username, $key);
$pswEncr = encryptthis($password, $key);
$users = DB::query('SELECT * FROM users');
foreach ($users as $user) {
if(decryptthis($user['username'], $key) == $username && decryptthis($user['password'], $key) == $password){
$user = array(
'id' => $user['id'],
'name' => $user['username']
);
setcookie("loginCredentials", json_encode($user), time() + 7200);
header("Refresh:0");
}
}
}
I have to select all users and decrypt all usernames and passwords to see if matched with given username and password because every time I encrypt the same word the encrypted string was different.
Is this a safe way to do it? Sorry for my bad English.
