Question

I am encrypting values of variables that I am sending through hyper link such that it is not easily editable by user..Suppose I have list of values that are shown in hyper link.

<a href="p_view.php?title=<?= hash('sha512', time() + $row['p_id'])]?>"><?=$row['p_name'] ?></a>

Now I want to navigate to view.php where I want to get back value of $row['p_id'] from the title. Is their any way to do So? What are other functions that encrypt on manage.php and decrypt again view.php page?

Answer 1

You appear to be confusing encryption and integrity assessment.

Integrity assessment:
If your purpose is detect when the user modified the values passed on the URL, a hash code (sometimes known as a Message Digest or a Checksum), such as one produce with SHA256 can suffice.
Simply add the URL an extra parameter value with a hash code. This hash code value can be produced by feeding the hash algorithm with the values which integrity you wish to assert, maybe along an extra secret “key” value (aka “salt”). Upon receiving a request, first verify that the hash produced by the values on the URL matches the hash of the URL; if it doesn’t at least one value on the URL was altered.

Encryption:
If your purpose is to hide from the user and others what kind of data/values are passed on the URL, encryption is necessary. Unlike a hash, Encryption algorithms can be reversed and produce back the original input from the encrypted text.
In most cases, encryption can also provide data integrity validation, because it is difficult for someone to alter the encrypted text in a way that it can be decrypted to a structurally valid text. Many encryption algorithms are such that altering even just one or two bytes in the encrypted text, results in producing “gibberish” at decryption time.

Practical suggestions with PHP:

• for hashing, use one of: crc32(), md5() and the like. (or also hash() as shown in the question’s code snippet).
• for encryption, use mcrypt_encrypt() / mcrypt_decrypt() from the MCrypt module
• depending on the algorithms used, remember to convert the encrypted output base64 or other format so that it can be part of a URL (many hashing and encryption methods produce binary data that include many characters susceptible of “breaking” urls)