Please note that this chapter was written for VERSION 3 of the Laravel PHP Framework.
Sometimes you need to protect your important data. Laravel provides two different methods to help you do that. One-way and two-way encryption. Let's take a look at these methods.
One Way Encryption
One way encryption is the best way to store user passwords, or other sensitive data. One way means that your data can be converted into an encrypted string, but due to a complex algorithm with painful maths, reversing the process is not possible.
This makes storing passwords a doddle! Your customers don't have to worry about you knowing their passwords, but you are still able to compare them (by hashing the password they provide) or change the password if needed.
Note that hashing is the process of creating a hash or encrypted string from another string.
Let's take a look at how password hashing works with one way encryption.
<?php
$pass = Input::get('password');
Now we have retrieved the password from our 'create user' form, but it's in plain-text! Let's hash it quickly so we can store it securely in our database.
<?php
$pass = Hash::make($pass);
We have used another of Laravel's highly expressive methods, this time make()ing a new Hash. Our $pass value will now contain a bcrypt encrypted version of our password, neat!
Let's say that our user has entered their password to login, and now we need to check to see if its authentic before they can be logged into the system. We can simply compare our hash to the value stored in the database with the check() method.
<?php
$pass = Input::get('password');
if ( Hash::check($pass, $user->password) )
{
// auth successful
}
The check() method accepts two parameters, the plain-text value provided by your user, and the hashed password that you have stored. It returns a boolean value to indicate whether the true values match or not.
What if we want to decode our data at a later date? Let's two way encrypt it.
Two Way Encryption
Two way encryption, allows you to return your encrypted data to its original form, kind of like those spy code sheets you played with when you were a kid!
The Laravel Crypter class uses AES-256 encryption which is provided by the Mcrypt PHP extension, so make sure that this PHP extension has been installed before attempting to use the class!
The Crypter class works using two simple methods, encrypt() and decrypt(), let's take a look at encrypting a string.
<?php
$secret = Crypter::encrypt('I actually like Hello Kitty');
Now our dirty little secret has been AES-256 encrypted, and the result has been returned. This would be of no use if we couldn't decrypt the secret at a later date. Let's look at how you can decrypt an encrypted piece of data.
<?php
$decrypted_secret = Crypter::decrypt($secret);
Easy as that! Simply hand the encrypted string to the decrypt() and the decrypted result is handed back.
Enjoy using the Crypter class to simulate the feeling of using your super secret decoder rings you got that one time in a cereal box!
My books are available online for free to encourage learning. However, if you'd like for me to keep writing, then please consider buying a digital copy over at Leanpub.com.
It's available in PDF, ePub, and Kindle format, and contains a bunch of extras that you won't find on the site. I have a full-time job, and I write my books in my spare time. Please consider buying a copy so that I can continue to write new books from the comfort of my sofa!