Question

A client has an online job application form that will be collecting social security numbers for a background check. Right now we are using RSForm Pro and Joomla 1.5. I have it set up so that the form is using SSL and the ssn field is a password field (not that it really does anything), but there is no encryption on the database side. I checked with RSJoomla (the maker of RSForm) and they said there is no default capability for this. I looked at the way the database is set up, and it’s a bit odd.

My question is this- is anyone familiar with how RSForm works enough to tell me where to begin trying to encrypt/decrypt a particular field (or all of them, if that’s easier)?

And how is the best way to go about this? From what I’ve gathered I should use AES and probably some salt.

Answer 1

You’re right, AES would be a good method.

I have never seen the code used for RSForms so can’t give you an exact answer.

The syntax used for AES encryption and decryption are:

AES_ENCRYPT(str, key_str);
AES_DECRYPT(crypt_str,key_str);

So to insert a data field into your database, would be something like this:

$key = 'ASKSDFNSDFKEISDJAHDLDSDF1235UUUiidfsdf'; 
INSERT INTO #__tablename VALUES (AES_ENCRYPT($_POST['social_security_number'],$key));

Please always try things like this on a localhost before you integrate it on your live site.