CFML decrypt string from database on the fly

Question

I have the following script that tries to select some items from my database and decrypt the encrypted ones, the problem is the encryption key is made unique with a changing company_id I have in my table:

<cfset request.ek = "password">
<!-- <cfset encKey = encrypt(request.ek, company_id)> -->
<!-- <cfset decrypted = decrypt(urldecode(arguments.mystring), encKey)> -->

<cfquery name="header" datasource="MyDB">
    SELECT TOP 10
        ID,
        company_id,
        encString
    FROM 
        dbo.[TableName];
</cfquery>

<cfoutput>ID|company_id|encString<br></cfoutput>

<cfloop query="header">
    <cfoutput>#ID#|#company_id#|#decrypt(urldecode(encString, encrypt(request.eq, company_id)))#<br></cfoutput>
</cfloop>

I get this error:

Parameter validation error for the DECRYPT function.
The function accepts 2 to 6 parameters.

EDIT. Thanks Scott Stroz, I really messed with the parentheses. My code should be:

<cfset request.ek = "password">
<!-- <cfset encKey = encrypt(request.ek, company_id)> -->
<!-- <cfset decrypted = decrypt(urldecode(arguments.mystring), encKey)> -->

<cfquery name="header" datasource="MyDB">
    SELECT TOP 10
        ID,
        company_id,
        encString
    FROM 
        dbo.[TableName];
</cfquery>

<cfoutput>ID|company_id|encString<br></cfoutput>

<cfloop query="header">
    <cfoutput>#ID#|#company_id#|#decrypt(urldecode(encString), encrypt(request.eq, company_id))#<br></cfoutput>
</cfloop>

As an aside, if this data is important, you really should switch to a stronger algorithm. [`cfmx_compat` is the least secure of the available algorithms](http://help.adobe.com/en_US/ColdFusion/9.0/CFMLRef/WSc3ff6d0ea77859461172e0811cbec22c24-7c2f.html) and only included for backward compatibility with older versions. — Leigh, Apr 01 '13 at 15:49

score 3 · Accepted Answer · edited Sep 04 '15 at 02:52

3

Your call to decrypt() near the end of your code sample only has 1 argument. Looks like it might be a problem with your parentheses.

It looks like:

decrypt(urldecode(encString, encrypt(request.eq, company_id)))

might need to be:

decrypt(urldecode(encString), encrypt(request.eq, company_id))

assuming

that you encrypted string in the database was then url encoded before insert.
you encrypted the string with a key of ( request.eq encrypted with a key of company_id ).

edited Sep 04 '15 at 02:52

Leigh

28,765
10
55
103

answered Apr 01 '13 at 14:25

Scott Stroz

7,510
2
21
25

How come? I open 3 parentheses and close 3...ohhh, got it. – bsteo Apr 01 '13 at 15:33

CFML decrypt string from database on the fly

1 Answers1