Home/ Questions/Q 7931313
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-03T20:40:53+00:00

This is what I’m trying to do : I have a CMS website, in

  • 0

This is what I’m trying to do :

I have a CMS website, in my admin panel i can add some packages users can buy from my website. So in my Choose.php page, users can select which package the want to buy. And of course the price is set for each package not by them, but by me.

If they click on a package, the page sends the data to another page like this :

$form  = '<form action="/buy.php?'product_name='.$name.'&product_id='.$product_id.'&price='.$ammount.'" method="post" target="_parent" ><input type="submit"     style="background-image:url(images/p.png);height: 55px;width: 118px;" value=""/></form>';

So users only click on predefined packages. If a user is some how expert in PHP, or even in scripting, he can easily change the url like :

product_name=MYPRODUCT&product_id=1&price=1000$

to something like this :

product_name=MYPRODUCT&product_id=1&price=10$

this means, they can buy the same package for 10& instead of 1000$.

So i need to ecrypt this url which is gernerated for each package separately, to something like this :

$form  = '<form action="/buy.php?MVNnaPgxpQizqwv7YElroi5E" method="post" target="_parent" ><input type="submit"     style="background-image:url(images/p.png);height: 55px;width: 118px;" value=""/></form>';

then in my Buy.php page, this encrypted string, deycrypts.

But the problem is with the decryption part, because when I deycrypt it, it says it’s an Array ( because i use $_GET to get the url ).

And when I use array deycription methods, i get an error in my first page, which it says the value i’m encrypting is a String not an Array. ( Remember : product_name=MYPRODUCT&product_id=1&price=1000$           which is a string. )

So how can i encrypt a string in one page, send it through url ( with $_POST ) then in the Buy.php page, use the $_GET and deycrypt it to arrays.

Sorry if it becomes a long post. And I need an encryption/decryption code.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    For security reasons I would advise you not to forward any sensitive data through GET/POST parameters!
    Even if they are encrypted, there might be a way for attackers to encrypt it and bring a lot of damage to you.

    You should store the price of the product in a database. When the user selects a product you forward to sth. like

    $form = ‘<form action=”/buy.php?id=34″>’

    And in buy.php you then retrieve the price and additional informations from the database.

    My advise is to read or at least have a look at PHP Security Guide

    • 0