0

I'm making a web app where people can leave their phone numbers for me to call back. The app doesn't have to be air-tight, but I wanted at least a little bit of protection, so I used XOR Cipher to hide the phone numbers in the database (this is in addition to other measures). After implementing this, I realized that my search function (search by phone number) would not work unless the full phone number was entered as a search term. I understand why this happened, but I'm wondering if there's a way I could still do searches using just a partial phone number.

My table has the following headings: id, phoneNumber, Name.

This is the function I used to cipher the phone numbers:

function xor_it($phoneNum) {
  $key = ('mykey');
  $string = $phoneNum;
  $output = '';
  for($i=0; $i<strlen($string); ) {
    for($j=0; ($j<strlen($key) && $i<strlen($string)); $j++,$i++) {
      $output .= $string{$i} ^ $key{$j};
    }
  }
  return $output;
}
$phoneNum = "1234567890";
$phoneNum = xor_it($phoneNum);

I realized that the ciphered string could not be properly stored in my phpMyAdmin database (some of the string showed up as little rectangular boxes), so I used base64_encode($phoneNum) before storing it into the database.

All of these means I cannot use a SQL query like the following:

"SELECT * FROM contacts WHERE phoneNumber LIKE '%{$searchTerm}%'";

If I use base64_decode(xor_it($searchTerm)), the search term must be identical to the stored number in order to produce a result. This makes it difficult if I want to, for example, search numbers by an area code.

I thought maybe I could do it by fetching all the rows from the database, then push the results to an array, followed by an array_search() function.

// select all from contacts

// declare an array to store the table values
$results_array = array();

while($row = mysqli_fetch_assoc($query_sql) {
  // need to decode and XOR it to ge the original number
  $phoneNumber = xor_it(base64_decode($row['phoneNumber']));

  // push every row into array as "ID:phoneNumber"
  $result_item = "{$row['id']}:{$phoneNumber}";
  array_push($results_array, $result_item);
}
if(!array_search($results_array, $searchTerm)) {
  // no results found
}
else {
  $position = array_search($results_array, $searchTerm);
  $rowID = explode(":", $results_array['$position']);
  $rowID = $rowID['0'];
  // query the database for the row with $rowID
}

Unfortunately, array_search() doesn't search by partial phone numbers either. I read a few "search encrypted text" articles, but they seemed to be about actual encryption methods. I couldn't follow at all as I'm still relatively new to this. Some people have said to add an extra column with a one-way hash, but I don't see how that helps with searching.

Any help would be greatly appreciated! I'm also open to other ways of ciphering the phone number column. However, as I said, I am new to this, so I'm really hoping for something simple!

Panpaper
  • 451
  • 1
  • 6
  • 16
  • 1
    XOR is not a cipher – Marcin Orlowski May 28 '19 at 08:13
  • 1
    @MarcinOrlowski sorry, like I said, I'm new to this. I read the following: https://stackoverflow.com/questions/9262109/simplest-two-way-encryption-using-php/30189841 https://www.go4expert.com/articles/xor-cipher-php-t5555/ – Panpaper May 28 '19 at 08:17
  • 1
    @MarcinOrlowski actually you can cipher with XOR. The key should have the same length of bytes. It was used since the early days. You get your initial data by re-XORing the cipher with your key. It has flaws though, IIRC knowing that german reports began with weather forecast, these flaws allowed to be able to crack the enigma machine. [see on wikipedia](https://en.wikipedia.org/wiki/XOR_cipher) – Kaddath May 28 '19 at 10:07
  • If you limit your search to a prefix-search, you can search the db for matching phone numbers by xor-encoding the prefix and using it to match encoded phone number prefixes. – Adder May 28 '19 at 10:55
  • I did xor-encode the search term, and prefixes work. Is there any way I can get suffixes to work? – Panpaper May 28 '19 at 16:25
  • Can I recommend going a totally different direction here? 1. https://github.com/paragonie/easydb 2. https://ciphersweet.paragonie.com – Scott Arciszewski May 29 '19 at 17:59

0 Answers0