AES encryption wrapper
Your XOR-step is nonsense, it doesn't add any security.

The reason is the way the CTR mode works: It encrypts a counter (thus the name) using the key (and the IV as starting point), and XORs the plaintext with the result.
XORing the plaintext with some other constant before encryption can be undone by XORing it with the same value after encryption.

Still, CTR mode (with or without this XOR) should be enough for protection, as long as your IV is non-repeating. To break it with some known plaintext, you basically have to brute-force encrypt the counter with different keys, until you get the same output as plaintext XOR ciphertext (for one block).

Also, you are using a simple MD5 hash for integrity protection. While MD5 might be fine in this case, it now has the reputation of being broken (i.e. there are quite easy collision attacks), which makes it not safe. Use a MAC algorithm for integrity protection, for example with hash_hmac (and a strong hash function like sha256, which you used before).

Other than that, PHP's rijndael-192 is not one of the AES algorithms. AES is Rijndael with block size of 128 bits (and key sizes of 128, 192 or 256 bits), and you are using an 192-bit block size version here. (This does not necessarily mean it is less secure, you just shouldn't call it AES. It did receive less cryptoanalysis than the variant that got standardized as AES, though.)