有些字符串不会解密

Question

我有一个用盐/密码加密和解密字符串的功能，但是有一个问题，我加密任何字符串都没有问题，但是解密它在解密一些字符串时有问题......

例如，它将解密“Hello World”，但不能解密“Login”或“RedeemToken”...我使用的代码如下所示，其中包含一些输出和调试内容：

function encrypt($data)
{
    $secret = "FUSIONIDISTOPNOTCHCODEDBYMELTYNET";
    //Generate a key from a hash
    $key = md5(utf8_encode($secret), true);

    //Take first 8 bytes of $key and append them to the end of $key.
    $key .= substr($key, 0, 8);

    //Pad for PKCS7
    $blockSize = mcrypt_get_block_size('tripledes', 'ecb');
    $len = strlen($data);
    $pad = $blockSize - ($len % $blockSize);
    $data .= str_repeat(chr($pad), $pad);

    //Encrypt data
    $encData = mcrypt_encrypt('tripledes', $key, $data, 'ecb');

    return base64_encode($encData);
}

function decrypt($data)
{
    $secret = "FUSIONIDISTOPNOTCHCODEDBYMELTYNET";
    //Generate a key from a hash
    $key = md5(utf8_encode($secret), true);

    //Take first 8 bytes of $key and append them to the end of $key.
    $key .= substr($key, 0, 8);

    $data = base64_decode($data);

    $data = mcrypt_decrypt('tripledes', $key, $data, 'ecb');

    $block = mcrypt_get_block_size('tripledes', 'ecb');
    $len = strlen($data);
    $pad = ord($data[$len-1]);

    return substr($data, 0, strlen($data) - $pad);
}

上面的函数也是这样使用的：

echo encrypt($string);
echo decrypt($string);

一些加密但不会加密的字符串示例：

Login - Doesn't Decrypt
RedeemToken - Doesn't Decrypt
Blacklist - Decrypt Works
Email - Decrypt Works

如果有人能指出问题或帮助，请告诉我，谢谢！

这是我的代码：

使用 - "http://example.com/test.php?st=xeJuD3+A0Po="

<?php

$string123 = mysql_escape_string($_GET["st"]);

echo decrypt($string123);

function encrypt($data)
{
    $secret = "FUSIONIDISTOPNOTCHCODEDBYMELTYNET";
    //Generate a key from a hash
    $key = md5(utf8_encode($secret), true);

    //Take first 8 bytes of $key and append them to the end of $key.
    $key .= substr($key, 0, 8);

    //Pad for PKCS7
    $blockSize = mcrypt_get_block_size('tripledes', 'ecb');
    $len = strlen($data);
    $pad = $blockSize - ($len % $blockSize);
    $data .= str_repeat(chr($pad), $pad);

    //Encrypt data
    $encData = mcrypt_encrypt('tripledes', $key, $data, 'ecb');

    return base64_encode($encData);
}

function decrypt($data)
{
    $secret = "FUSIONIDISTOPNOTCHCODEDBYMELTYNET";
    //Generate a key from a hash
    $key = md5(utf8_encode($secret), true);

    //Take first 8 bytes of $key and append them to the end of $key.
    $key .= substr($key, 0, 8);

    $data = base64_decode($data);

    $data = mcrypt_decrypt('tripledes', $key, $data, 'ecb');

    $block = mcrypt_get_block_size('tripledes', 'ecb');
    $len = strlen($data);
    $pad = ord($data[$len-1]);

    return substr($data, 0, strlen($data) - $pad);
}
?>

Answer 1

找到 ;)

在您的网址中，使用http://example.com/test.php?st=xeJuD3%2BA0Po%3D 作为=+ 并且不允许在网址中使用其他字符。

查看http://php.net/manual/fr/function.rawurlencode.php 以根据您的 base64 加密数据制作正确的 URL

如果您无法在 URL 到达 PHP 之前更改它，则必须将+ 中的空格改回：

$_GET['st'] = str_replace(' ', '+', $_GET['st']);

顺便说一句，删除$string123 = mysql_escape_string($_GET["st"]); mysql_ 是用于mysql，仅此而已，这不是你到处施放的魔法。它唯一要做的就是将' 更改为\'，它不会在任何地方帮助你；即使在 MySQL 中，它现在也已贬值，您需要使用 PDO 或 mysqli

---

为此：

<?php
function encrypt($data)
{
    $secret = "FUSIONIDISTOPNOTCHCODEDBYMELTYNET";
    //Generate a key from a hash
    $key = md5(utf8_encode($secret), true);

    //Take first 8 bytes of $key and append them to the end of $key.
    $key .= substr($key, 0, 8);

    //Pad for PKCS7
    $blockSize = mcrypt_get_block_size('tripledes', 'ecb');
    $len = strlen($data);
    $pad = $blockSize - ($len % $blockSize);
    $data .= str_repeat(chr($pad), $pad);

    //Encrypt data
    $encData = mcrypt_encrypt('tripledes', $key, $data, 'ecb');

    return base64_encode($encData);
}

function decrypt($data)
{
    $secret = "FUSIONIDISTOPNOTCHCODEDBYMELTYNET";
    //Generate a key from a hash
    $key = md5(utf8_encode($secret), true);

    //Take first 8 bytes of $key and append them to the end of $key.
    $key .= substr($key, 0, 8);

    $data = base64_decode($data);

    $data = mcrypt_decrypt('tripledes', $key, $data, 'ecb');

    $len = strlen($data);
    $pad = ord($data[$len-1]);

    return substr($data, 0, strlen($data) - $pad);
}

echo "'". ($a = encrypt('Email'))."'<br>\n";
echo "'".decrypt($a)."'<br>\n";
echo "'".decrypt('AA/PpTmKWjY=')."'<br>\n";
echo "'".($e= encrypt('Login'))."'<br>\n";
echo "'".decrypt($e)."'<br>\n";
echo "'".decrypt('xeJuD3+A0Po=')."'<br>\n";

我明白了：

'AA/PpTmKWjY='
'Email'
'Email'
'xeJuD3+A0Po='
'Login'
'Login'

所以，对我来说它工作正常......