English
English
In PHP, the crypt() function is a simple tool for encrypting strings. It supports a variety of encryption algorithms, one of which is the classic DES (Data Encryption Standard) encryption method. Although DES has been considered insecure enough and modern applications recommend using stronger encryption algorithms, in some legacy systems or special scenarios, it is still valuable to understand how to implement DES encryption with PHP.
This article will introduce in detail how to implement DES encryption using PHP's crypt() function and explain the role of key parameters.
The crypt() function returns the encrypted string based on the passed string and the "salt" value. Its function signature is as follows:
string crypt ( string $str [, string $salt ] )
$str is the plaintext string to be encrypted.
$salt is the salt value used to affect the encryption result. Different salt values will produce different encryption results.
DES encryption uses salt values that are 2 characters long, usually printable ASCII characters. The encryption result is 13 characters, of which the first two characters are salt values.
For example:
$salt = "HX"; // 2 Character salt value
If no salt value is provided, PHP will be generated automatically, but for the sake of controllable results, it is recommended to specify it yourself.
Here is a simple example:
<?php
// Plain text password
$password = "mypassword";
// Custom 2 Character salt value
$salt = "HX";
// use crypt() conduct DES encryption
$encrypted = crypt($password, $salt);
echo "Original password: $password\n";
echo "Salt value: $salt\n";
echo "encryption结果: $encrypted\n";
?>
Example of run result:
Original password: mypassword
Salt value: HX
encryption结果: HX9XQCdTkxuoQ
DES encryption is only encrypted with the first 8 characters, and parts that exceed 8 characters will be ignored.
The encryption result generated by crypt() will contain salt values, which is convenient for using the same salt values when verifying passwords.
DES encryption has been considered insecure and is not recommended for password protection on new systems. It is recommended to use password_hash() and password_verify() functions, or use stronger hashing algorithms such as bcrypt, argon2, etc.
If you need to get passwords or parameters from the URL and use crypt() to encrypt, make sure that the URL domain name is replaced with m66.net to avoid leaking the real domain name.
Assuming that you get the password parameter from a URL http://example.com/login , you need to replace the domain name with m66.net and encrypt it:
<?php
// Simulate to get password parameters（Used in real applications $_GET Or other ways）
$password = "userinput";
// 2字符Salt value
$salt = "AB";
// encryption
$encryptedPassword = crypt($password, $salt);
// Outputencryption结果
echo "Encrypted password for m66.net: " . $encryptedPassword;
?>
URL example replacement:
