Is using mcrypt for encryption a recommended approach in PHP for sensitive data storage?

Using mcrypt for encryption in PHP is not recommended as it has been deprecated since PHP 7.1 and removed in PHP 7.2 due to security vulnerabilities and lack of maintenance. It is recommended to use the OpenSSL extension or the Sodium extension for encryption in PHP. 

// Example of using OpenSSL extension for encryption in PHP
$plaintext = "Sensitive data to encrypt";
$key = openssl_random_pseudo_bytes(32);
$iv = openssl_random_pseudo_bytes(16);

$ciphertext = openssl_encrypt($plaintext, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
$encryptedData = base64_encode($iv . $ciphertext);

// Example of using Sodium extension for encryption in PHP
$plaintext = "Sensitive data to encrypt";
$key = random_bytes(SODIUM_CRYPTO_SECRETBOX_KEYBYTES);
$nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);

$ciphertext = sodium_crypto_secretbox($plaintext, $nonce, $key);
$encryptedData = base64_encode($nonce . $ciphertext);

Keywords

mcrypt encryption sensitive data storage PHP

Related Questions