Passing sensitive information using GET or POST

[mattd55]

Hey folks, kind of a PHP newbie.  Basically, we have two websites which I need to pass information securely from one to the other.  It is basically, login parameters and then conduct a search.  I do not need to create a web service or any type of middleware solution at this time, I just need a quick and secure method of passing username/pass and the search parameters.  I read a nice article (although old) that stated I could pass the data as follows, in either a cookie or a form variable.

 

$encrypteddata = mcrypt_ecb(MCRYPT_TripleDES, "Secret key", serialize($data), MCRYPT_ENCRYPT);

$encrypteddata = bin2hex($encrypteddata);

 

$encrypteddata = hex2bin($encrypteddata);

$data = unserialize(mcrypt_ecb(MCRYPT_TripleDES, "Secret key”,$encrypteddata, MCRYPT_DECRYPT));

 

(And yes, I do realize the mcrypt_ecb function is depreciated)

 

However, I believe that with this solution, if I pass it in the URL, I could potentially use up the 2,000+ character limit.

 

My question is, is there a better way to do this?  Or different approach I could use?  Thanks in advance.  Great board!

[GingerRobot]

You could always post the data to the second website using cURL.

 

Im not sure if there are any particular security issues with this sort of method however.

[frio80]

Yes, I really need to read-up on cURL.  Thanks for the response.

[trq]

Doesn't matter if you use curl or not, the request has still got to go via get or post.

[GingerRobot]

I was meaning sending the data using POST via cURL. As far as i know, there is no character limit when using POST is there?

[frio80]

No limit on POST.  I used cURL with POST with great success.  I was thinking about the flow of data incorrectly.  The solutions was to simply supply a link with some search params to my php script, i cURL a static link with those search param and voila, a POST is generated and returned with I need the data I need!