have the code, but what's this error?

Question

Alright, I'm trying to encrypt files when they are uploaded onto a server. I've found code here at stackoverflow, but I'm having problems implanting it. I'm getting the error unexpected '(', expecting ',' or ';' in where/the/file/is.php. It's pointing to the const KEY = md5('somesecretcode'); line. I know that it's saying that it's expecting the end of the line after the md5, but I'm not sure why? You think it would accept the now "encrypted" string as a valid string. If need be, I'll upload some more code up hear. Thanks for your help in advance! I'm kind of new to this so please don't be too rough.

Here's the code

<?php

class Encryption
{
const CYPHER = MCRYPT_RIJNDAEL_256;
const MODE   = MCRYPT_MODE_CBC;
const KEY    = md5('somesecretcode');

public function encrypt($plaintext)
{
    $td = mcrypt_module_open(self::CYPHER, '', self::MODE, '');
    $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
    mcrypt_generic_init($td, self::KEY, $iv);
    $crypttext = mcrypt_generic($td, $plaintext);
    mcrypt_generic_deinit($td);
    return base64_encode($iv.$crypttext);
}

public function decrypt($crypttext)
{
    $crypttext = base64_decode($crypttext);
    $plaintext = '';
    $td        = mcrypt_module_open(self::CYPHER, '', self::MODE, '');
    $ivsize    = mcrypt_enc_get_iv_size($td);
    $iv        = substr($crypttext, 0, $ivsize);
    $crypttext = substr($crypttext, $ivsize);
    if ($iv)
    {
        mcrypt_generic_init($td, self::KEY, $iv);
        $plaintext = mdecrypt_generic($td, $crypttext);
    }
    return trim($plaintext);
}
}

?>

and I'm calling it like...

$encrypted_string = Encryption::encrypt('this is a test'); // Åž-\Ž“kcþ1ÿ4gî:Xƒã%
$decrypted_string = Encryption::decrypt($encrypted_string); // this is a test

Answer 1

You can't use function calls or arrays along with const. You will have to find another way to set the constant (or just hard code the value of md5('somesecretcode')).

Answer 2

You cannot use "const", because this gets parsed at compile time where function calls are not yet possible.

You can use define function like this

define('KEY', md5('somesecretcode'));

This is a function, gets executed at runtime and will work. You will have to place it somewhere where it can be executed - like class constructor for example.

But using define in this context is not a very good design, because then creating an instance of your class will write something into global (or into the namespace ) scope.

So you need to rethink your solution. If you insist on keeping static method calls, maybe pass the secret into the function as input parameter?

Answer 3

You should not use a function to init a const variable outside the constructor.
You can do instead:

class Encryption
{
    const CYPHER = MCRYPT_RIJNDAEL_256;
    const MODE   = MCRYPT_MODE_CBC;
    const KEY    = '';

    public function __construct(){
        $this->KEY = md5('somesecretphrase');
    }
...

Update:
This is NOT TRUE!
Even though this code seems to be working what it really does is creating another object member called KEY (even though it doesn't have the $ - which is kind of confusing) and assigning it with md5('somesecretphrase'). This member is not a constant and can be changed at any time.
The class member KEY which can be referred to by self::KEY remains empty!