while my friends and I planning to run our own website, we're confused about the encryption where hackers can TAPPING or in social engineering it's WIRE TAPPING, but I don't know how do they call it in Computers today...

Well guys, I just want to know how encryption works with websites if we are using PHP+MYSQL?

Is it ok to use

  1. user login ----> (PHP) encrypt inputted value then (PHP) will decrypt and validate it going to (MySQL)
  2. user login ----> (PHP) encrypt inputted value and decrypt the (MySQL) data if they are similar...

Is it similar if we use $_SESSION without encryption inside PHP going to MySQL?or PHP encryption also helps the manipulation of binaries?..I'm so confused T_T...

In regards to what I stated above, can a hacker hook the data if the server uses $_SESSION? Is $_SESSION safe?... IF THE HACKER CAN HOOK it? is it necessary to use SSL on our website? and why do some Merchandise websites use SSL and likewise facebook also uses SSL?

what is the best suit for you if there is no SSL? encrypting the DATA using PHP going to MySQL or even without encryption while the PHP server uses $_SESSION?...

  • 1
    This makes no sense. Why would you want to use encryption between PHP and MySQL, which will probably run on the same server? – NullUserException Nov 12 '11 at 2:31
  • 1
    I also tried to edit your question but the language is extremely confusing. Can you clean it up a little? – NullUserException Nov 12 '11 at 2:32
  • totally agree with @NullUserExceptionఠ_ఠ : As for as i know ssl encryption is supposed to be used betwwen your server and your client – Dany Khalife Nov 12 '11 at 2:33
  • sorry about that, im just confuse about it, why they need to use ssl if all manipulation are server side? – ChowKiko Nov 12 '11 at 2:36

Your question is lacking grammar, but I think I got the gist of what you are asking.

$_SESSION is only stored on the server, it never goes across the wire, and therefore cannot be intercepted. It is identified by a cookie which can be intercepted, this is the man avenue for session hijacking.

You can do a lot of unnecessary work and get encryption working in javascript, but it is a lot smarter to just use SSL, which is extremely secure and will prevent anyone from intercepting data that is being passed between the client and server. If your application requires a significant amount of security then SSL is your only legitimate option.

| improve this answer | |
  • thanks man, and by the way, does facebook uses a COOKIE to store the User's information? – ChowKiko Nov 12 '11 at 2:50
  • 1
    Yes and no. Facebook uses several cookies, one of which is the session id. It uses that cookie to load the session into php when a request is received. – regality Nov 12 '11 at 3:02

Encryption is just a way to convert a human readable string into something that is not readable by humans for example I'm going to pass an input hidden field in a particular form and it's actually an email, for security purposes I have to convert the whole email string into something not readable for humans (this is where encryption happens) so that I could avoid hackers from hacking other accounts but when the form is passed to the application server the encrypted data which is not readable to humans will be decrypted meaning getting it back to it's original form which is readable again and do the process needed.

While SSL works the same with encryption the difference only is that the whole data submitted are encrypted and it's more complicated than just encrypting a single string like encryption of email etc to be more specific it's actually a protocol same as http, ftp, sftp etc. I could not explain it well but I guess this article might explain it more http://en.wikipedia.org/wiki/Secure_Sockets_Layer.

I hope this helps you. ;)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy