5 replies to this topic

[lol33d]

Hi guys,

I want create a web site for banking.

i need a solution for inserting data in database, i want encrypt username and emails address, becuse
hackers when hack or admin server can't see my records (users and emails of members)

i want create a algorithm for this,

In your opinion, this is a good way?

please give me your solutions

thank you so much

[WingedPanther]

As a general rule of thumb: if they have access to your database, they likely have access to your PHP, and can decrypt the data. The PHP has to exist in the DMZ, the database should be behind a firewall. Therefor, if they can access your database you have BIG problems.

[Vaielab]

Banking website are not simply created.
They have to be watched 24hours a day. Each bank (at least the one I work with) have team of programmer/security network/other geek guy working all day long to ensure the data is safe.
Since you are responsable for the money, if the money get stolen, you are responsable to refund the money to the people.

Plus, if you are talking about admin server can't see your record, you must be on a shared server. And this is really a big risk.
If you have a bug in your code, or if someone else on the server have some sort of bug, a hacker could take your data. So even if you are fully protected (and this is impossible) you are still at risk.

[lol33d]

Thank you Guys,

The banking system is example, My System is on the localhost and the database is on the server.

(Connect of localhost to server database. and admin server cant access to my algorithm)

and server admin only can access the database.

what do you recommend about that?

give me solution please.

[WingedPanther]

You're still going to be dealing with the server admin having access to the PHP when you go live.

This sounds like there's something going on that you aren't telling us. WHY do you want the email addresses encrypted? Of all the things to consider secure data, that's not high on my list.

[Vaielab]

You could try to obfuscate your php code, but this will only make it hard to see the code, not impossible.