title: AES-256 in PHP and securely storing keys?
body: <p>I have the following code...</p>
  
  <pre><code>   $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);
     $iv = mcrypt_create_iv($iv_size, MCRYPT_DEV_URANDOM);
     $key = pack("H*", "Insert64CharacterStringHere");
  
     $value = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $value, MCRYPT_MODE_CBC, $iv);
  
     $value = $iv . ":" . $value;
  </code></pre>
  
  <p>I'm using this to encrypt data in AES-256 on my site. I store the initialization vector with the data being encrypted, and between the data and the initialization vector is a colon so that I can explode the string later into the initialization vector and the data, then decrypt. </p>
  
  <p>What I'm wondering about is where to store the key. If I store it on the same database, it's almost as insecure as simply leaving the data unencrypted. I have a feeling leaving the key lying around somewhere in my PHP code is just as insecure. </p>
  
  <p>Where should the key be stored? Is this an appropriate way to store the initialization vector? Am I safe using the colon as a deliminator? I.E. will the initialization vector or the data ever contain a colon?</p>