PHP Mcrypt_decrypt decrypt only parts of the original string - php

Question

I have a weird problem regarding passing an encrypted string through url. I'm using base64 encryptions from mcrypt() for encryptHTML() and decryptHTML().
I have this piece of code to encrypt:
$link_string = http_build_query(array('index_number'=>30843854, 'extra_attendence_id'=>27982423, 'target_temporary_id'=>378492085, 'date'=>'2016-05-06', 'action'=>'OUT', 'target_id'=>390234), '', '&');
$link_string = encryptHTML($link_string);
then I passed it through this url:
'localhost/website/controller/action/'.$link_string
then I decrypted it with this piece of code:
$id = $this->request->param('id');
$id = decryptHTML($id);
parse_str($id, $arr_id2);
var_dump($arr_id2);
I will get these in return, as expected:
array(6) { ["index_number"]=> string(8) "30843854" ["extra_attendence_id"]=> string(8) "27982423" ["target_temporary_id"]=> string(9) "378492085" ["date"]=> string(10) "2016-05-06" ["action"]=> string(3) "OUT" ["target_id"]=> string(6) "390234" }
The next case is when I still want the encrypted link but I need to attach some other value from DOM element in the page, so I tried to
'localhost/website/controller/action/encrypt='.$link_string.'&DOMvalue=10000'
then I modified the decryption with this piece of code:
$id = $this->request->param('id');
parse_str($id, $arr_id2);
$the_DOMValue = $arr_id2['DOMvalue'];
$id = decryptHTML($arr_id2['crypted']);
parse_str($id, $arr_id);
var_dump($the_DOMValue); echo "<br>";
var_dump($arr_id);
But then, I get these in return, to my surprise:
string(5) "10000"
array(3) { ["index_number"]=> string(13) "58_2016-04-26" ["extra_attendence_id"]=> string(1) "0" ["target_t"]=> string(0) "" }
My original string was cut short! Note that the DOMvalue is fine.
Then, I checked that right before both decryption, if the given encrypted string is different:
on first case of decryptHTML:
$id = $this->request->param('id');
var_dump($id);
$id = decryptHTML($id);
returns:
string(224) "zCQnh-rNP2R7h4UHyV5Dm5zp494DIIku5LWN51yYGMXBaHf0gJgEDw8UCuHRZxr-CkjkevHQ70kOPnSBQ9CJP6lZrFone-nDMDJhYlL8330wz+zud8-3tSWvdOLB7je5D-22aX4OrE3zlBYZZZtI-rMT73H0JGIRzZge2GzcZGLwS7Rj+GL5Ym-ET6JEHDShST4etgcQaEYXml-+BZ2+0BQKvubZEBOB"
on the second case of decryptHTML:
$id = $this->request->param('id');
parse_str($id, $arr_id2);
$the_DOMValue = $arr_id2['DOMvalue'];
var_dump($arr_id2['crypted']);
$id = decryptHTML($arr_id2['crypted']);
returns:
string(224) "zCQnh-rNP2R7h4UHyV5Dm5zp494DIIku5LWN51yYGMXBaHf0gJgEDw8UCuHRZxr-CkjkevHQ70kOPnSBQ9CJP6lZrFone-nDMDJhYlL8330wz zud8-3tSWvdOLB7je5D-22aX4OrE3zlBYZZZtI-rMT73H0JGIRzZge2GzcZGLwS7Rj GL5Ym-ET6JEHDShST4etgcQaEYXml- BZ2 0BQKvubZEBOB"
It looks exactly the same to me, but strangely it was decrypted differently. I of course used the same functions to decrypt both cases...
Anybody can shed me some light on this?

Answer 1

passing an encrypted string through url
Passing an encrypted string through a URL is a bad idea. Full stop.
I'm using base64 encryptions from mcrypt() for encryptHTML() and decryptHTML().
Without seeing what these functions do, this isn't helpful information, but mcrypt should be avoided. Use Libsodium (if you can; otherwise, use OpenSSL) instead.
My original string was cut short!
It probably treated the + as a space. Using urlencode() would fix one problem, but it wouldn't solve the vulnerability to chosen-ciphertext attacks that using mcrypt introduces into your application in the absence of a Message Authentication Code (MAC).