I have a PHP query here that updates an existing field in my client database. This page is what I use to add a social security number, which I want to use AES_ENCRYPT to encrypt it. For some reason, this does nothing. Can anyone find any problems with it?

<?php

@require("./config.php");
@require_once("/home/me/public_html/func/db.php");

include("/home/me/encryptioninfo.php");


    if($_POST['submit']){
           $uid = $_POST['id'];
           $ssn1 = $_POST['ssn'];

mysql_query("Update clients Set ssn=aes_encrypt('$ssn1','$aes_key') where id='$uid'");
           echo "Success. ";
exit();

}else{

$uid = $_GET['user_id'];

}
?>

<form method="post" action="encryptssn.php">
<?php 
echo $uid;
?>
<input type="text" name="ssn" size="20">
<input type="hidden" name="id" value="$uid" size="20">



<input type="submit" name="submit" value="Add" class="button">
</form>

I don't know what the problem is but if you replace:

mysql_query("Update clients Set ssn=aes_encrypt('$ssn1','$aes_key') where id='$uid'");


with:
mysql_query("Update clients Set ssn=aes_encrypt('$ssn1','$aes_key') where id='$uid'") or die( mysql_error() );

you should at least get some feedback from MySQL itself.

Are you getting $aes_key from the config.php file? If not, where is that variable coming from?

Nick

TwistMyArm- When I changed the code for the die I got no results when I ran the script.

nmallare- $aes_key is coming from encryptioninfo.php

Thanks for the quick responses guys!

What exactly do you mean by "it does nothing" ?

Nick

I think it is single and double quote problem.
Use this

PHP Code:

$query = "Update clients Set ssn=aes_encrypt('$ssn1','$aes_key') where id='$uid'"
$result = mysql_query($query); 


Instead of This

PHP Code:

mysql_query("Update clients Set ssn=aes_encrypt('$ssn1','$aes_key') where id='$uid'"); 


Hopefully, It will work!

Kirtan- I tried that, nothing either.

What I mean by "it does nothing" is that I get the echo "Success." and no errors- but when I go look at the field (lets say for ID 3 (The row)) in phpMyAdmin- it is empty (whether the column type is text or blob).

Should I post my connection info from db.php? Don't know why that should be the problem- I have several other scripts running off of the same file.

PHP Code:

mysql_query("UPDATE clients SET ssn=AES_ENCRYPT('$ssn1',$aes_key) WHERE id='$uid'"); 


Just curious as to what that does.

Nick

nmallare,
Without the single quotes around $aes_key I get a unknown column in 'field list' error.

Hmmm, I think that's the value of $aes_key?

Put the single quotes back around it and make sure it still isn't working.

Nick

That's not the value of $aes_key. I don't know what that was, but it was no where close to my key.

Back to where we where with the single quotes.

Just as a test, do this:

PHP Code:

$encrypted_password = md5(md5($ssn1)); 


And then do this:

PHP Code:

mysql_query(" ... SET ssn='$encrypted_password' ... "); 


Nick

You could also try:
mysql_query("UPDATE `clients` SET `ssn`=AES_ENCRYPT('$ssn1','$aes_key') WHERE `id`=$uid");

You really shouldn't have single quotes aroudn $uid as it's a number, not a string (I presume).

Actually, the code works well with me. MySQL documentation recommends to use BLOB rather than TEXT field in DB to avoid potential problem. But it works with both fields. I think, the problem lies in form (may be submit using $_SERVER['PHP_SELF']) or in include files.

Ok, I finally got it.

I ditched the db.php config and set it up in the file to eliminate any potential problems.

Another problem was with the hidden input value $uid (was not in PHP). Works now! THANK YOU to everyone who helped me with this one and hopefully it will serve as reference to others in the future.