I’ve written a licensing script for some modifications I release freely, and part of my terms and conditions states that upon installation the modification will send the following information for storing in my database:-
- Domain Name where the mod is installed
- Email address of the site owner
- Modification name
- Modification version number
All of my modification code is ioncube encrypted, and I’m sending the values through an image URL like so:
http://www.example.com/licenses.php?modname=".$modname."&modversion=".$modversion."&domain=".$domain."&email=".$email."
I’m using an image so that I can return an image to the users browser showing whether a code update is available based on what the user currently has installed.
I’d like to ensure user privacy when sending between domains and send these values encoded, but I’m unsure what encryption is the most appropriate for this situation? I need to be able to decode the values for comparison against the database, but anything that can be decoded by me could easily be decoded by anyone else? What am I missing here? I’m sure others have tried to do this thousands of times before.
Any pointers would be most appreciated.
Don’t reinvent the wheel. Use HTTPS/TLS/SSL. If you tell us what web server you’re using for the destination, we can point you to setup guides. You may want to use POST in addition. However, it’s not really necessary, because TLS will protect the entire query string. A common reason to use POST for secure data is to prevent people accidentally storing data in bookmarks, history, etc., which I don’t think applies here.