I want to scramble / unscramble a software license key into / from mysql database

Question

I want to store software license keys in a field of my mysql db, but I want to have the license number stored in a scrambled format so that if the db is compromised the license keys won't be usable.

There are 3 scenarios possible with the license key field:

1. It may be null - some users won't have a license key stored in the db yet.
2. It may be a 25 digit license, with every 5 characters separated by a hypen: for example: ABCD1-EFGH2-IJKL3-MNOP4-QRST5
3. It may be a 10 digit license, all of which are numbers and there are no separators: for example: 1234567890

I'd like to scramble the license prior to storing, then when displaying to the user once logged in, run the same scramble function again to unscramble the license.

I think I would need to start by checking the strlen of the license.

1. If 0, then do nothing. I can check if its null before loading the function.
2. If 29, then use the hyphen separators to shuffle sections of the license, such as 2nd & 4th and maybe use str_rot13 to change the alpha characters.
3. If 10, select say the 3rd, 5th, 7th, & 9th characters and change their order. such as 5th with 9th and 3rd with 7th.

I've setup the following:

    function scramble($scramblestr) {

    // check string length
    $length = strlen($scramblestr);

    // if 10 digit license (all numbers)
    if ($length == 10) {
        $1st = substr($scramblestr, 0, 1);
        $2nd = substr($scramblestr, 1, 1);
        $3rd = substr($scramblestr, 2, 1);
        $4th = substr($scramblestr, 3, 1);
        $5th = substr($scramblestr, 4, 1);
        $6th = substr($scramblestr, 5, 1);
        $7th = substr($scramblestr, 6, 1);
        $8th = substr($scramblestr, 7, 1);
        $9th = substr($scramblestr, 8, 1);
        $10th = substr($scramblestr, 9, 1);

        // swap 3rd character with 7th / swap 5th character with 9th
        $scramblestr = $1st . $2nd . $7th . $4th . $9th . $6th . $3rd . $8th . $5th . $10th;

    // if 25 digit license (with hyphen separators)
    } elseif ($length == 29) {
        $scramblestr = array_filter(explode('-', $scramblestr), 'strlen');

        // swap 2nd & 4th sections
        $scramblestr = $scramblestr[0] . "-" . $scramblestr[3] . "-" . $scramblestr[2] . "-" . $scramblestr[1] . "-" . $scramblestr[4];

        // swap alpha characters 13 places in the alphabet
        $scramblestr = str_rot13($scramblestr);

    // if null or if stored incorrectly (for example if the license is not null but contains an invalid number of characters)
    } else {
        $scramblestr = "Unknown";
    }

    return $scramblestr;
}

However, this results in the following server 500 error:

PHP Parse error: syntax error, unexpected '1' (T_LNUMBER), expecting variable (T_VARIABLE) or '$'

This points to the 1st substr reference. However, according to php.net it should be a integer used here to demark length of string.

Any ideas?

Or is there a more efficient way of performing this action? Or does anyone have any alternative methods which may suit?

Answer 1

"@Fred & CaptainCarl you were both right, how could I of not realised that... changed the $st to $first and so on... – BottyZ"

Submitting as an answer:

The problem here is that your variables start with a numeric value; can't do that. Do something like $a1st as opposed to $1st while starting with a letter.

References on Stack you can have a read:

• Why variable can not start with a Number?
• Why can't variable names start with numbers?

Answer 2

A valid variable name starts with a letter or underscore, followed by any number of letters, numbers, or underscores. As a regular expression, it would be expressed thus: '[a-zA-Z_\\x7f-\\xff][a-zA-Z0-9_\\x7f-\\xff]*'

https://secure.php.net/manual/en/language.variables.basics.php

The naming of your variables, eg $1st is invalid.

Answer 3

You can also encrypt the data in the database in MySQL 5.7 or MariaDB 10.1. You can do it with a single field, tables or completed tablespace including logfiles etc.

see: https://mariadb.com/kb/en/mariadb/encryption/