MySQL - How to store AES_Encrypted data?

php mysql security encryption aes
user569322 picture user569322 · Sep 18, 2011 · Viewed 16.6k times · Source

So I have been browsing the internet, and came across the MySQL built-in function AES_ENCRYPT. It doesn't seem too hard to use, but some sources tell me to store the encrypted data as a VARCHAR, and some say to store it as a BLOB. What should I store the encrypted data as?

Answer

Tadas Kvedaras picture Tadas Kvedaras · Sep 18, 2011

Many encryption and compression functions return strings for which the result might contain arbitrary byte values. If you want to store these results, use a column with a VARBINARY or BLOB binary string data type. This will avoid potential problems with trailing space removal or character set conversion that would change data values, such as may occur if you use a nonbinary string data type (CHAR, VARCHAR, TEXT).

Source: http://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html

Related questions

How can I prevent SQL injection in PHP?

If user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example: $unsafe_variable = $_POST['user_input']; mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')"); That's …

Read More
SQL injection that gets around mysql_real_escape_string()

Is there an SQL injection possibility even when using mysql_real_escape_string() function? Consider this sample situation. SQL is constructed in PHP like this: $login = mysql_real_escape_string(GetFromPost('login')); $password = mysql_real_escape_string(GetFromPost('password')); $sql = "…

Read More
How to secure phpMyAdmin

I have noticed that there are strange requests to my website trying to find phpmyadmin, like /phpmyadmin/ /pma/ etc. Now I have installed PMA on Ubuntu via apt and would like to access it via webaddress different from /phpmyadmin/. What …

Read More