PHP encryption and decryption internal algorithm

<?php
function Passport_encrypt ($txt, $key) {
Srand (Double) microtime () * 1000000);
$encrypt _key = MD5 (rand (0, 32000));
$ctr = 0;
$tmp = ';
for ($i = 0; $i < strlen ($txt); $i + +) {
$ctr = $ctr = = strlen ($encrypt _key)? 0: $ctr;
$tmp. = $encrypt _key[$ctr]. ($txt [$i] ^ $encrypt _key[$ctr + +]);
}
Return Base64_encode (Passport_key ($tmp, $key));
}

function Passport_decrypt ($txt, $key) {
$txt = Passport_key (Base64_decode ($txt), $key);
$tmp = ';
for ($i = 0; $i < strlen ($txt); $i + +) {
$MD 5 = $txt [$i];
$tmp. = $txt [+ + $i] ^ $MD 5;
}
return $tmp;
}

function Passport_key ($txt, $encrypt _key) {
$encrypt _key = MD5 ($encrypt _key);
$ctr = 0;
$tmp = ';
for ($i = 0; $i < strlen ($txt); $i + +) {
$ctr = $ctr = = strlen ($encrypt _key)? 0: $ctr;
$tmp. = $txt [$i] ^ $encrypt _key[$ctr + +];
}
return $tmp;
}
?>
Here are some examples ... Deepen the understanding of these three cryptographic decryption functions ...
string.php
<?php
Include "fun.php";

$txt = "This is a test";
$key = "TestKey";
$encrypt = Passport_encrypt ($txt, $key);
$decrypt = Passport_decrypt ($encrypt, $key);

echo $txt. " <br>echo $encrypt. " <br>echo $decrypt. " <br>?>
array.php
<?php
Include "fun.php";

$array = Array (
"A" => "1",
"B" => "2",
"C" => "3",
"D" => "4"
);
Serialize produces a value that can be stored, returns a string, Unserialize restores
$txt = serialize ($array);
$key = "TestKey";
$encrypt = Passport_encrypt ($txt, $key);
$decrypt = Passport_decrypt ($encrypt, $key);
$decryptArray = Unserialize ($decrypt);

echo $txt. " <br>echo $encrypt. " <br>echo $decrypt. " <br>echo $decryptArray. " <br>?>
The key to the place ... When you want to jump to another URL, but to ensure that your session is correct, you need to deal with the session. Looks like a company has a website and there is a forum, two places have registered and login, but do not want to let users in the home page to jump to the forum when the session fails , that is, log in once run the entire company ...
Then how to deal with the user's session ...
The Web page is stateless, if you want to continue using the session in a new Web page, you need to move the session from one place to another, as some may have thought, and I can call it by URL. and PHP has a variable that handles the session, called $_. Session. So ....
Convert the session you want to register into an array. Well, you can write this:
login.php
<?php
Session_Start ();
Include "fun.php";
....
$_session["UserID"];
$_session["username"];
$_session["Userpwd"];
...
Header ("location:http://$domain/process.php?s=". UrlEncode (Passport_encrypt (Serialize ($_session), "SessionKey") );
?>
In the example above, the $_session is converted into a stored data by using serialize, and then the data is encrypted by Passport_encrypt, and the reason for adding urlencode is that it is possible to generate unexpected coding when $_session is encrypted. So just in case ... (It turns out to be very effective)
Deal with the first
process.php
<?php
Session_Start ();
Include "fun.php";
$_session=unserialize (Passport_decrypt ($_get["s"], "SessionKey"));
Header ("location:http://$domain/index.php");
?>
First Use $_get["s"] to get the parameters of the URL, then use Passport_decrypt to decrypt it, and then use Unserialize to restore its data to the original data
By this step, your page will be free to jump through the header ....
This approach also involves security issues, if your URL address in the process of access by others, it is really embarrassed ... Although others may not be able to decipher the contents of the URL, but people can also directly use this URL to login to some of your personal accounts Ah, mailbox accounts and even bank accounts (of course, very few will write this, I exception, haha) ... It sounds so scary ... but actually you can cancel session processing on the jump page ....
The following is the enhanced version of process.php
<?php
Session_Start ();
Include_once "fun.php";
$_session=unserialize (Passport_decrypt ($_get["s"], "SessionKey"));
if ((Time ()-$_session["Time"]) >30) {
Header ("location:http://$domain/login.php");
Unset ($_session["USERNAME"]);
Unset ($_session["PASSWORD"]);
}
Else
Header ("location:http://$domain/index.php");
?>
Before you write this file, you have to set up the login
$_session["Time" = time ();
The main reason to set this is to get both sides of the time, if the jump time more than 30 seconds, you can let it jump to the login.php login page, the slow speed of the customer is embarrassed ... But this also prevents if this URL is taken, and the person does not log in within 30 seconds, then sorry Ah, timeout login again.
$_session["USERNAME"] and $_session["PASSWORD" These two things are user login needs to enter the username and password .... The reason for canceling these two sessions is because if your URL is captured by someone, Although the person in more than 30 seconds to jump to the loign.php page, but those passed through the session is still valid, as long as the URL suffix login.php to index.php .... That's the same as he logged in successfully ...