Encrypting Data with OpenSSL in PHP

Use an authenticated cipher such as AES-256-GCM with fresh random nonces and authenticated tags.

The objective is to understand the behavior and operational limits, not only the method name.

What It Does

Use an authenticated cipher such as AES-256-GCM with fresh random nonces and authenticated tags.

Prerequisites

Use a dedicated development environment and sample data. Where a snippet uses an injected connection, repository, request value or mailer, supply it from your own application setup.

Example 1: Basic Use

A focused working pattern for this topic. Names such as $pdo, $authContext and $repo represent dependencies provided by the application unless initialized in the snippet.

<?php
$key = random_bytes(32); // Replace with a managed 32-byte secret.
$nonce = random_bytes(12);
$tag = '';
$ciphertext = openssl_encrypt('confidential', 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag);
if ($ciphertext === false) throw new RuntimeException('Encryption failed');
$payload = base64_encode($nonce . $tag . $ciphertext);
echo $payload;

Example 2: A Second Scenario

A second use case that adds a different operation or data flow specific to this topic.

<?php
$cipher = 'aes-256-gcm'; $key = random_bytes(32); $nonce = random_bytes(12); $tag='';
$encrypted = openssl_encrypt('invoice number', $cipher, $key, OPENSSL_RAW_DATA, $nonce, $tag);
$plain = openssl_decrypt($encrypted,$cipher,$key,OPENSSL_RAW_DATA,$nonce,$tag);
if ($plain !== 'invoice number') throw new RuntimeException('Authentication failed');

Example 3: Practical Checks

A practical validation, failure or deployment concern specific to this topic.

<?php
$key = random_bytes(32); $nonce = random_bytes(12); $tag='';
$encrypted = openssl_encrypt('test','aes-256-gcm',$key,OPENSSL_RAW_DATA,$nonce,$tag);
$tag[0] = chr(ord($tag[0]) ^ 1);
if (openssl_decrypt($encrypted,'aes-256-gcm',$key,OPENSSL_RAW_DATA,$nonce,$tag) !== false) throw new RuntimeException('Tampering went undetected');

Important Behavior and Edge Cases

Store keys in a secret manager, never reuse nonces with the same key, and reject decryption when tag verification fails.

For production use, also account for error handling, data validation, resource limits and environment-specific driver behavior.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Use an authenticated cipher such as AES-256-GCM with fresh random nonces and authenticated tags.
• Store keys in a secret manager, never reuse nonces with the same key, and reject decryption when tag verification fails.
• Use this workflow as a focused starting point rather than a substitute for application-level tests.

Choose this API or pattern when its exact semantics match your task, and verify the result against the database driver and runtime used by your application.