我将如何编码某些 $_GET 参数？
我目前正在使用 base64_encode 来处理一些我不希望普通用户弄乱的 $_GET 参数。 我想知道 base64 看起来不太强大，是吗？
我也不想进行某种大型编码，这不是很多重要的信息，但我不希望具有平均知识的用户会弄乱 get 中的参数。
我应该继续使用 base64 吗？目前，如果值为 1，它会生成 MQ==，因此很容易从 URL 中取出它并解码，然后插入您自己的。
Im currently using base64_encode for some $_GET params that i don't want regular user to mess with.
I was wondering that base64 is not looking too strong or is it ?
I also don't want to make some sort of mega encoding it's not so much of important information, but i would not like that user with average knowledge would mess with params in get.
Should i keep using base64 ? Currently it produces MQ== if value is 1 so it's quite easy to take it out from URL and decode and then insert your own.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
如果您想要一些真正的加密/解密，请查看 PHP 的 Mcrypt 功能。 http://www.php.net/manual/en/mcrypt.examples.php
但是，由于 URL 规范在字符使用和 URL 长度方面受到限制，您可能希望使用 POST 而不是 GET。
If you want some real encryption/decryption take a look at the Mcrypt features of PHP. http://www.php.net/manual/en/mcrypt.examples.php
But then you may want to use POST instead of GET because of the URL specifications which are limited in character usage and URL length.
取决于你想用它做什么。
如果您只是想混淆它（特别是当您用 Javascript 等生成这些 URL 时），您可以将 ROT13 应用于 URL 并交换一些额外的字符，以使解码变得更加困难。
但是，如果您的应用程序的安全性依赖于它，您可以在数据服务器端应用静态密钥对称加密，并在收到请求时对其进行解码。我认为有这样的框架。
Depends on what you want do do with it.
If you just want to obfuscate it (especially when you're generating those URLs in Javascript or so), you could apply ROT13 to the URL and swap a few additional characters to make decoding it a little bit more difficult.
However, if the security of your application depends on it, you could apply a static-key symmetric encrytion on the data server-side and decode it when you receive a request or so. I think that there are frameworks or so for that.
Base-64 编码 不会以任何方式保护数据。这是一个简单的基数转换，就像使用十六进制代替十进制整数一样。
如果您只想验证数据完整性，您可以使用加盐哈希（带有秘密盐）与数据一起存储的。例如，请参阅哈希消息身份验证代码 (HMAC)。
Base-64 encoding doesn’t protect the data in any way. It’s a simply base conversion like using hexadecimal instead of decimal for integers.
If you just want to verify data integrity, you can use a salted hash (with a secret salt) that you store along with the data. See for example the hashed message authentication code (HMAC).
base64_encode()不是安全措施！它旨在通过通常仅传输 ASCII 的介质来发送二进制 blob。使用会话，或正确加密您的变量。
我建议只使用会话，并将其存储在默认的
/tmp之外，以便更好地测量...base64_encode()is not a security measure! It was designed to make sending of binary blobs possible through mediums that typically transfer ASCII only.Use a session, or properly encrypt your variables.
I would recommend just using a session, and storing it out of the default
/tmpfor good measure with...