PHP & HTML: Encrypt form

Question

Hi all,

I have forms within my website. Some of these forms include PayPal forms (forms that submit information to PayPal). I do not wish my customers to view the source code and see what fields & their respective values I am using. As such I wish to encrypt them and yet, be able to submit information securely over to PayPal with the values that user enters in the form & my own hidden form values.

So for example, consider that one of the elements of my form is:

<input name="note" type="text" id="note" value="<?php echo ( isset($_POST['note']) ? $_POST['note'] : '' ); ?>" maxlength="255" />

When I view the source code, I see something like this:

<input name="note" type="text" id="note" value="This is my first note" maxlength="255" />

So it's very clearly visible what note I am sending. I do not want anyone to see what I am sending and to where. So if possible, can we encrypt the fields & their values so that user sees something like the following when he views the source code:

aXKJKJHlnkhGHKJBjKJOIKJKG5dsaGjhvbSDHAHOSDLnNDNOjkjsadndKHKDNSQW

The above would represent the encrypted form of the field. Is this possible to achieve without using Javascript? I would really want to do this without javascript because the form field values would be dynamic & javascript could be disabled.

Thank you very much.

Edit1: I just wanted to add this Note to specify that I would apply the same encryption process to all other forms & they may or may not post to PayPal. So keeping this in view, it would help to know an encryption routine in general & not just in specific to Paypal. Any ideas?

Answer 1

Encrypting anything with javascript is a bad idea, people can turn it off. Your best bet is to capture the information you want from the user, post the form to another php file which collects the data, adds the note and submits the form to paypal itself with the extra information(read this).

Answer 2

It looks like you're sending the browser over to PayPal's site so they can pay you, and for that to work, PayPal needs to know your identity and the amount of the transaction. PayPal as a number of APIs you can use, so for example if you can get an HTTPS certificate you can do everything on the server side. If not, then see if they don't have a deal where they ask your server for transaction details based on a unique transaction id instead of getting EVERYTHING from the browser. You'll probably be happier with that other API.

Good luck!

Oh, and don't forget, it's entirely OK if someone knows how to give you money!

Answer 3

You can encrypt the data on the server before sending it over to PayPal, as said before, this is your best bet, as it can't be decrypted by anyone apart from PayPal.

There's a tutorial here which seems quite helpful. As you're using PHP already, it should just be a copy and paste job.

Answer 4

The short answer is no.

In order for your page to be rendered correctly, the HTML must be readable by the browser. Unfortunately, this usually means that it must also be readable by humans (either by View Source or by using a DOM inspector).

You could protect against View Source by using packed/minified JavaScript to build your entire page, but that's a nightmare for accessibility and if your users have JavaScript disabled, then there's no page for them to see. This is not a good idea.

Look at any page on the internet and View Source on it. You'll see all the form fields and elements that are on the page (unless they were created by JavaScript, in which case using a DOM inspector will allow you to see them anyway).

If you're worried about security, then server-side input validation, as well as HTTP referrer checking is about your best bet.