PHP - Plus sign with GET query

Question

I have a PHP script that does basic encryption of a string through the method below:

<?php
$key = 'secretkey';
$string = $_GET['str'];

if ($_GET['method'] == "decrypt")
{
    $output = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($key), base64_decode($string), MCRYPT_MODE_CBC, md5(md5($key))), "\0");
}

if ($_GET['method'] == "encrypt")
{
    $output= base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($key), $string, MCRYPT_MODE_CBC, md5(md5($key))));
}

echo $output;
?>

An example of a URL to encrypt a string would look like this:

Encrypt.php?method=encrypt&str=the quick fox

Which would return this as the encrypted string:

LCuT/ieVa6cl3/4VtzE+jd9QPT3kvHYYJFqG6tY3P0Q=

Now to decrypt the string all you have to do is change the "method" query to "decrypt", like so:

Encrypt.php?method=decrypt&str=LCuT/ieVa6cl3/4VtzE+jd9QPT3kvHYYJFqG6tY3P0Q=

The only problem is that when that encrypted string is decrypted it returns this:

¬ƒ§rYV}̳5Äš·nßì(ñïX8Þ;b

I have narrowed down the problem to the plus sign that is in the encrypted string. PHP's GET method seems to translate a plus sign into a blank space. I have searched this bug and found out that it has already been filed here. I have tried different methods listed on that page and others with no success. The closest I got is by using this:

$fixedstring = str_replace(" ", "+", $string);

and then using $fixedstring in the encryption methods, the problem is, upon decryption, all blank spaces are converted to plus signs. Any ideas?

I know using POST would make more sense but I am using GET for specific reasons. I will spare the details.

Answer 1

If you'll read the entirety of that bug report you'll see a reference to RFC 2396. Which states that + is reserved. PHP is correct in translating an unencoded + sign to a space.

You could use urlencode() the ciphertext when returning it to the user. Thus, when the user submits the ciphertext for decryption, you can urldecode() it. PHP will do this automatically for you if it comes in via the GET string as well.

Bottom line: The + must be submitted to PHP as the encoded value: %2B

Answer 2

I realize that this is an old question, but I was looking for a solution to a similar problem with + signs in a GET string. I stumble upon this page and thought I would share the solution I came up with.

<?php
$key = 'secretkey';
$string = $_GET['str'];

if ($_GET['method'] == "decrypt")
{
    $string = urlencode($string);
    $string = str_replace("+", "%2B",$string);
    $string = urldecode($string);
    $output = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($key), base64_decode($string), MCRYPT_MODE_CBC, md5(md5($key))), "\0");
}

if ($_GET['method'] == "encrypt")
{
    $output= base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($key), $string, MCRYPT_MODE_CBC, md5(md5($key))));
}

echo $output;
?>

Answer 3

You should be using urlencode() before putting the encrypted string on the query string, which will "escape" any special characters (including +) and then call urldecode() before decrypting it, to revert them back to their original form.

Answer 4

none of the above answers worked for me, I fixed the "+" sign problem using

rawurldecode() 

and

 rawurlencode() 

Answer 5

We ran into the same problem trying to pass a URL to a PHP script with a string variable containing the "+" symbol. We were able to make it work with;

encodeURIComponent([string])

EG:

var modelString = "SEACAT+PROFILER";
modelString = encodeURIComponent(modelString);
//"SEACAT%2BPROFILER"

The %2B passes the correct value to the PHP GET as @hobodave said, and we get back the right data set.

Hope this helps someone else who ran into something like this, and needed a slightly different take on the examples above.

Answer 6

In my case the problem was that $_GET parameters were not decoding correctly when being used for a MYSQL query. So if you just need to pass the $_GET content to a mysql query then simply encode it (no need to decode anything) like this:

<a href='processor.php?name=".urlencode($str)."'>".$str."</a></td>