Search code examples
sql-serverencryptioncoldfusioncfml

CFML decrypt string from database on the fly


I have the following script that tries to select some items from my database and decrypt the encrypted ones, the problem is the encryption key is made unique with a changing company_id I have in my table:

<cfset request.ek = "password">
<!-- <cfset encKey = encrypt(request.ek, company_id)> -->
<!-- <cfset decrypted = decrypt(urldecode(arguments.mystring), encKey)> -->

<cfquery name="header" datasource="MyDB">
    SELECT TOP 10
        ID,
        company_id,
        encString
    FROM 
        dbo.[TableName];
</cfquery>

<cfoutput>ID|company_id|encString<br></cfoutput>

<cfloop query="header">
    <cfoutput>#ID#|#company_id#|#decrypt(urldecode(encString, encrypt(request.eq, company_id)))#<br></cfoutput>
</cfloop>

I get this error:

Parameter validation error for the DECRYPT function.
The function accepts 2 to 6 parameters.

EDIT. Thanks Scott Stroz, I really messed with the parentheses. My code should be:

<cfset request.ek = "password">
<!-- <cfset encKey = encrypt(request.ek, company_id)> -->
<!-- <cfset decrypted = decrypt(urldecode(arguments.mystring), encKey)> -->

<cfquery name="header" datasource="MyDB">
    SELECT TOP 10
        ID,
        company_id,
        encString
    FROM 
        dbo.[TableName];
</cfquery>

<cfoutput>ID|company_id|encString<br></cfoutput>

<cfloop query="header">
    <cfoutput>#ID#|#company_id#|#decrypt(urldecode(encString), encrypt(request.eq, company_id))#<br></cfoutput>
</cfloop>

Solution

  • Your call to decrypt() near the end of your code sample only has 1 argument. Looks like it might be a problem with your parentheses.

    It looks like:

    decrypt(urldecode(encString, encrypt(request.eq, company_id)))
    

    might need to be:

    decrypt(urldecode(encString), encrypt(request.eq, company_id))
    

    assuming

    1. that you encrypted string in the database was then url encoded before insert.
    2. you encrypted the string with a key of ( request.eq encrypted with a key of company_id ).