PHP Code:

// insert into database
include("encryptioninfo.php");

$query = "INSERT INTO ".MYSQL_TBL_CLIENTS." SET $query_string, lastupdate=NOW(), date_referral=NOW()";

$query2 = "Update ".MYSQL_TBL_CLIENTS." Set ssn=aes_encrypt(ssn,'$aes_key') where (????);

$result = mysql_query($query);
$result = mysql_query($query2); 


How do I do what I am trying to accomplish here? I have a long form where I want all of the values inserted into a DB, but I want the one field to be encrypted. I don't know how to do the AES_ENCRYPT with the first query because of the $query_string, so I thought you could run a second query when the form was submitted afterwards to encrypt the ssn value... But I don't know what to do for where. Each new entry is assigned an increasing ID with a bigint. Please help?

Well, for a starter, you are mixing INSERT and UPDATE syntax:

insert:

INSERT INTO tblName
(filed1, field2,field3)
VALUES
(value1, value2, value3)

update:

UPDATE tblName
SET field1=value1, field2=value2, field3=value3
WHERE primaryKeyField=xxx

Secondly, you have an PHP syntax error, on the $query2 line.

PHP Code:

$query2 = "Update ".MYSQL_TBL_CLIENTS." Set ssn=aes_encrypt(ssn,'$aes_key') where (????); 


should be:

PHP Code:

$query2 = "Update ".MYSQL_TBL_CLIENTS." Set ssn=".aes_encrypt(ssn,$aes_key)." where (????);";
// !! Check the "ssn" parameter in the aes_encrypt function up there. 
// If it's not a constant, it will trigger an error. 


Now, what should your $query_string contain?
Is it the values of your form?

Then, you should compose your script differently. Hit the $_GET ot $_POST arrays directly.
You will found all the variables of your form there.
For exemple, if you have an input field named "ssn" in your form and are sumitting with a POST method:

PHP Code:

$ssn=$_POST['ssn']; 


Simply repeat this for all your forms fields (or use a foreach, or extract), and compose your query that way.

foreach example:

PHP Code:

/**
 * Does the same as extract(), but you could use the loop to do other  
 * actions. All the indexes in the $_POST array are traversed with this.
 * !!! the $$name is not a typo. It means "create a variable with the name as the content of $name".
 * So, if $name="heyYou", then it will create a variable $heyYou
 */
foreach($_POST as $name=>$value){
  $$name=$value;
} 


That doesn't really help considering the form works as is, $query_string is the values of the form fields.


Couldn't I just do a query like this and remove the value="$_POST[ssn]" from the SSN field?

PHP Code:

$query = "INSERT INTO ".MYSQL_TBL_CLIENTS." SET $query_string, ssn='aes_encrypt('$_POST[ssn]','$aes_key')', lastupdate=NOW(), date_referral=NOW()"; 


Yes, you could too.
It's up to you to determine if it's secure enough.

Keep in mind that anyone with malicious mind could save your page on disk, and alter the form to post other fields.
Try to avoid SQL injection attacks too.
Believe me, they are real.
http://en.wikipedia.org/wiki/SQL_injection

Hmm. What do you recommend to prevent against SQL Injection attacks? Restrict the input to alphanumerical chars only to run the query? I've never heard of that before and looked into it some.. pretty tricky.

There is a good writeup on SQL Injection here in this forum:
http://www.webmaster-talk.com/php-fo...injection.html

Preventing SQL Injection is simply escaping any attempt to let the user "rewite" you query.

You can clean user input like: mysql_real_escape_string(stripslashes($_POST['ssn']))