Base64_encode in url

I used base64_encode in url, this was the best way I’ve found to protect the parameters passed via url. The biggest problem so far is that I have to manipulate string after decoding the url in order to find the parameters again, this is too much work because I need to use it often.

I wanted to know if what I did is safe and if it really pays off.

Exemple:
www.mysite.com/index.php?id1=1&id2=2&id3=3
www.mysite.com/index.php?aWQxPTEmaWQyPTImaWQzPTM=

 

Try to use POST instead of GET. Then you will not have to encode the parameters.

(Use SSL if it is that important)

 

Impossible, because the url is for the user can access your page like in facebook, the parameres are fixed, containing user’s data collected from database.

 

Then say so in the beginning.

This says you are passing the parameters from one place to another. On the other end you use (say) PHP to decode the string. If you can use PHP on the receiving end, you can use GET as a method to send. Or you can use CURL to send originally.

If I am wrong here, then explain the whole thing better. Then maybe someone can help.

 

I appreciate the suggestions, but I made it clear I was just wanting to know if use base64_encode in url was safe and if it pays off.

 

It depends how you're checking the data when it's received. What's to stop me from decoding the original request, finding the structure and then base64 encoding my own, malicious parameters?

Also, another thing that is unsafe about sending base64 encoded strings in the URL is that base64 encode includes the characters "+", "=" and "/". These characters can change your data and the intentions of that data.

The best thing you can do to fix these issues are:

<?php
$url = 'Whatever you are doing for your parameters';
$encoded = urlencode(base64_encode($url));
?>

Then to process the data:


<?php
$decoded_url = base64_decode(urldecode($_GET['whatever']));
//now do your normal stuff
?>

 

To answer your actual question, no it's not safe, and no, it does not pay off.

I'm not sure what you're trying to protect, but if it's sensitive data, base 64 is definitely not the way to go. It's very very insecure!

Please explain in detail what you're trying to do, so someone can give you a good advice on how to solve this issue. But please don't use base 64 for sensitive data!

 

He's not sending sensitive data, he wants to protect the parameters, I've no idea why, but if he is setting sensitive information via a URL, he's doing it wrong altogether.

 

Well he said:

... not sure what these might contain, but I suspect it might be something important if he tries to protect it.

 

But he also said:

As an example. Giving the impression that he's only sending a few ID's, which is fine *if* he is handling the data correctly.

But yes, to answer the question he asked:

It does depend on what data you're sending, if you're not sending anything important then it's fine as long as you escape the characters "+", "=" and "/" as I've already mentioned.

 

Thanks for all the answers, explaining better, one of the ids carries the information responsible for the access control (the pages that user can access), becoming this parameter a sensitive data, then if it’s unprotected, it will can be easily changed, I know I should not have done that, but I don’t have choice because the system I’m working is already too big, then the better way I’ve found was protect the parameter’s name and his values.

Code posted by D3Tek:

<?php
$url = 'Whatever you are doing for your parameters';
$encoded = urlencode(base64_encode($url));?>

<?php
$url = 'Whatever you are doing for your parameters';
$encoded = urlencode(base64_encode($url));
?>

I had done exactly that, but then I thought that it wouldn’t help much. On second thought, this way is much safer.

 

This is a good example of security through obscurity. This will keep out the regular user, but if someone is a just a little curious, they'll break your system in a minute.

In your scenario (while keeping in mind that doing it right is not an option), I would suggest you encrypt the string using a custom encryption function using a private key only known to you. Or maybe give each user their own key, so if one gets brute forced, others aren't broken at the same time as well.

Take a look at this for example:
https://github.com/import/crypt-php

On the long run, I really suggest you change your system. But whatever you do, do not use base 64. It's literally the first thing I would try if I were to hack your system.

 

Sounds to me like you are passing *** client side that has no business being sent client-side. You need anything more than your PHP session or a randomly generated cookie hash for database driven sessions, you are doing something wrong... since anything you'd pass via GET shouldn't be 'security' related or even need to be obscured... that's either POST's job, or doesn't belong client side!

... and the mob is right, anyone that's actually a threat would slap that aside in a instant.