Can php be deployed encrypted?

Purpose of Encryption

##Encryption is different from password. Encryption is an action or process, and its purpose is It is to turn a piece of plain text information (information that can be directly read by humans or machines) into a piece of characters that seems to have no meaning. The information must be converted back to meaningful readable information through pre-agreed decryption rules. Encryption can prevent Unauthorized theft of information.

PHP encryption function (Recommended learning: PHP programming from entry to proficiency)

PHP’s encryption functions include crypt(), md5() and sha1(). Among them, crypt() is used for one-way encryption. The so-called one-way encryption means that after encrypting the content that needs to be encrypted, the ciphertext cannot be converted into readable content. Therefore, the application of one-way encryption The scope is relatively narrow and is generally used for user name authentication and password input. When the user enters the system, he only needs to enter the ciphertext password. After the system verifies that it is consistent with the stored password, he can pass.

md5() and sha1() belong to the hash algorithm. It is an irreversible algorithm. By intercepting any piece of initial information and converting it, the resulting content is the hash value, and the length fixed. In this way, even if the information is lost, it is meaningless to analyze the hash value, because it has no direct connection with the original information, so it has a strong encryption function. md5() uses the MD5 hash algorithm to convert a variable-length message into a 128-bit message digest.

The sha1() function uses the SHA-1 hash algorithm, and its principle is similar to md5().

md5() and sha1() are often used to verify the integrity of information, that is, by calculating the hash value of the file to verify whether the file has been modified, so two functions are needed to hash in PHP The value is calculated using md5_file() and sha1_file(). Once the calculated hash value is found to be different from the original value, it can be determined that the file has been modified.

Although these three functions are simple to operate, they are all irreversible and cannot decipher the ciphertext; however, in higher-level encryption work, the encryption effect of these simple encryption functions is somewhat limited. .

Encryption is always inseparable from security, and every PHPer must integrate application security into the code as a necessary design idea. Here are some best practice suggestions.

Don't use MD5, don't use sha1, basically there is no difficulty in cracking.

Please use password_hash to hash the password (php version is greater than or equal to 5.5, less than 5.5, please use the password_compat library), because the password_hash function has helped you handle the salting, and the random string used as the salt has been encrypted The algorithm becomes part of the hash, and the password_verify() function automatically extracts the salt from the hash, so you don't need to worry about the storage of the salt.

For the signature of the communication interface, please use an asymmetric algorithm to encrypt the signature key, set a validity period for the key, and replace it regularly.

The above is the detailed content of Can php be deployed encrypted?. For more information, please follow other related articles on the PHP Chinese website!