Question

Ideally I would want to encrypt the variables so there is no way to figure them out, however given that the client will send the variable via javascript and that anything can be decrypted if they see the code, I am looking for alternatives.

I was thinking of making using something that would return HEX similar to md5 or sha1 but encryption and then some how incorporate the server time or date into the variable so that the encryption would only be valid for 1-2 minutes.

The javascript would have an obfuscated/minimized function that would base the encryption on time according to javascript and then POST it to php. As long as the servers date/time was withing X minutes then it would decrypt correctly.

I’d like to send it what seems to be random data, and get back what seems to be random data. I dont want it to be the same data.

Is this the best method? I am only trying to stop people who try to use HTTP sniffers. I know once they get to the javascript source nothing could prevent it given enough time/understanding of what’s going on.

If you are going to post actual code, remember that the function/ability should exist on both javascript and PHP5 (< 5.3). I would like native simple/small functions not implement a huge third party class for JS and PHP.

Edit: SSL/HTTPS is out of the question.

Answer 1

I assume HTTPS is out of the question.

Have you thought about ROT? Stupid simple implementation at least:

var output = "";
for(var i = 0; i < input.length; i++)
{
    char = ( input.charCodeAt(i) + SOME_NUMBER ) %255;
    output += String.fromCharacterCode( char )
}

Then, in PHP

$chars = $_POST['chars'];
$output = "";
for($i = 0; $i < strlen($chars); $i++ )
{
    $char = ord($chars[$i]) - SOME_NUMBER;
    if($char < 0 )$char += 255;
    $output .= chr($char);
}