I want to know the best way of storing text in a database and encrypting it so as to prevent others (admin) from reading it. I'm allowing users to write (up-to) paragraphs of plain text and then storing in a database. This text is then displayed back to the user in their account. This means that I will have to be able to decrypt the data once i've encrypt it and stored it in the database. (I have created the project using PHP)
我想知道在数据库中存储文本并对其进行加密以防止其他人(管理员)读取文本的最佳方式。我允许用户编写(最新的)纯文本段落，然后存储到数据库中。然后将该文本显示回用户的帐户中。这意味着，一旦我对数据进行加密并将其存储在数据库中，我就必须能够解密数据。(我用PHP创建了这个项目)
Thanks
谢谢
4 个解决方案
#1
2
What you are looking for is MCrypt. Also if you are wanting the data to be truly secure you will need to use HTTPS for transport as once the PHP script has decrypted the cipher text (when the user is accessing the text) the plain text is sent out through the NIC of the server. So a crafty admin or attacker could just sniff the trafic on the interface and log the traffic.
你要找的是MCrypt。另外，如果您希望数据真正安全，那么您需要使用HTTPS传输，因为PHP脚本已经解密了密码文本(当用户访问文本时)，纯文本将通过服务器的NIC发送出去。因此，一个狡猾的管理员或攻击者可以在接口上嗅出trafic并记录流量。
#2
1
AES_ENCRYPT and AES_DECRYPT are easy ways to encrypt/decrypt strings without writing the code yourself, available in MySql 5 upwards.
AES_ENCRYPT和AES_DECRYPT是一种简单的加密/解密字符串的方法，不需要自己编写代码，可以在MySql 5中找到。
Be aware that the output of AES_ENCRYPT is a binary string, which needs to be stored in columns of a binary data type (most likely the appropriate one would be BLOB) instead of text types such as TEXT or VARCHAR that you would normally use for text data.
请注意，AES_ENCRYPT的输出是一个二进制字符串，它需要存储在二进制数据类型的列中(最合适的应该是BLOB)，而不是文本类型(如文本或VARCHAR)，您通常在文本数据中使用这些文本类型。
The problem is that you are going to have to store the encryption key somewhere, and you somehow have to keep the admin from accessing it. I don't know if that will be possible (admin of what exactly?)
问题是您必须将加密密钥存储在某个地方，并且您必须设法阻止管理员访问它。我不知道这是否可能(具体管理什么?)
#3
1
In fact, you can't prevent admin from viewing these texts as he'll be able to read encryption password as well and decrypt them.
事实上，你不能阻止管理员查看这些文本，因为他也可以读取加密密码并解密它们。
#4
-1
- Use a save connection (https) so your admin can not get the password from the logs.
- 使用一个save connection (https)，这样管理员就不能从日志中获取密码。
- Use MCript to encrypt decrypt the data with the users password.
- 使用MCript加密解密数据和用户密码。
- Decrypt the data with the users password.
- 用用户密码解密数据。
There is however one BIG drawback:
然而，有一个很大的缺点:
You will have to store the users password in cleartext in the session, so you MUST take care that session data is not stored in logs, the database, etc...
您将不得不在会话中以明文形式存储用户密码，因此必须注意会话数据不存储在日志、数据库等中……
If your admin has access to the php code it is a matter of seconds to hack this.
如果您的管理员可以访问php代码，那么破解它只需要几秒钟的时间。
The only case where this will work is if your Admin can access the database and the backend BUT NOT the code.
只有当管理员可以访问数据库和后端而不是代码时才会这样做。
#1
2
What you are looking for is MCrypt. Also if you are wanting the data to be truly secure you will need to use HTTPS for transport as once the PHP script has decrypted the cipher text (when the user is accessing the text) the plain text is sent out through the NIC of the server. So a crafty admin or attacker could just sniff the trafic on the interface and log the traffic.
你要找的是MCrypt。另外，如果您希望数据真正安全，那么您需要使用HTTPS传输，因为PHP脚本已经解密了密码文本(当用户访问文本时)，纯文本将通过服务器的NIC发送出去。因此，一个狡猾的管理员或攻击者可以在接口上嗅出trafic并记录流量。
#2
1
AES_ENCRYPT and AES_DECRYPT are easy ways to encrypt/decrypt strings without writing the code yourself, available in MySql 5 upwards.
AES_ENCRYPT和AES_DECRYPT是一种简单的加密/解密字符串的方法，不需要自己编写代码，可以在MySql 5中找到。
Be aware that the output of AES_ENCRYPT is a binary string, which needs to be stored in columns of a binary data type (most likely the appropriate one would be BLOB) instead of text types such as TEXT or VARCHAR that you would normally use for text data.
请注意，AES_ENCRYPT的输出是一个二进制字符串，它需要存储在二进制数据类型的列中(最合适的应该是BLOB)，而不是文本类型(如文本或VARCHAR)，您通常在文本数据中使用这些文本类型。
The problem is that you are going to have to store the encryption key somewhere, and you somehow have to keep the admin from accessing it. I don't know if that will be possible (admin of what exactly?)
问题是您必须将加密密钥存储在某个地方，并且您必须设法阻止管理员访问它。我不知道这是否可能(具体管理什么?)
#3
1
In fact, you can't prevent admin from viewing these texts as he'll be able to read encryption password as well and decrypt them.
事实上，你不能阻止管理员查看这些文本，因为他也可以读取加密密码并解密它们。
#4
-1
- Use a save connection (https) so your admin can not get the password from the logs.
- 使用一个save connection (https)，这样管理员就不能从日志中获取密码。
- Use MCript to encrypt decrypt the data with the users password.
- 使用MCript加密解密数据和用户密码。
- Decrypt the data with the users password.
- 用用户密码解密数据。
There is however one BIG drawback:
然而，有一个很大的缺点:
You will have to store the users password in cleartext in the session, so you MUST take care that session data is not stored in logs, the database, etc...
您将不得不在会话中以明文形式存储用户密码，因此必须注意会话数据不存储在日志、数据库等中……
If your admin has access to the php code it is a matter of seconds to hack this.
如果您的管理员可以访问php代码，那么破解它只需要几秒钟的时间。
The only case where this will work is if your Admin can access the database and the backend BUT NOT the code.
只有当管理员可以访问数据库和后端而不是代码时才会这样做。