title: Android encrypting URL parameters and values and decrypting server side
body: <p>I want to set up some basic web server protection to protect against replay attacks and data manipulation hacks. 
  At the moment, I make a REST request from the client (android) side such as: </p>
  
  <pre><code>http://www.example.com/add_book.php?user_name=eddy&amp;nonce=534365756756&amp;book_title=My%20First%20Book
  </code></pre>
  
  <p>Here, I am using a nonce that will be stored against the user's id and checked for duplicate requests. However, in this unencrypted system someone can simply insert their own (random) nonce. What I want do is convert the above request to something along the lines of:</p>
  
  <pre><code>http://www.example.com/add_book.php?fsjdfhdhsjfhdsjf538537854rj34i5348ur4rf4r3g4yrg4y32210dfsdjfsdhfjshru99jifjknjsdfnfjsfhuruwe
  </code></pre>
  
  <p>that can be unencrypted server side to the equivalent unencrypted URL so the parameters can be accessed with $_GET['book_title'] (like in the usual manner).</p>
  
  <p>In the ideal world, the request itself could be encrypted with the user's hashed password as an easy way to certify the user is who they say they are.</p>
  
  <p>I'm not really prepared to pay for an HTTPS certificate at this stage so that's not really an option. </p>
  
  <p>Does anyone know how I can do this? My requests are plain text atm so are incredibly vulnerable. 
  Thanks. </p>