<?php
// Configuration (Store your key securely, e.g., in config.php!)
$encryption_key = 'YourSuperSecretKey123!'; 
$cipher_method = "aes-256-cbc";
$field_to_encrypt = 'secret_data'; // The technical name of your field

// 1. Find the field in the data array prepared for the database
$index = array_search($field_to_encrypt, $fields_to_process);

if ($index !== false && !empty($values_to_process[$index])) {
    $plaintext = $values_to_process[$index];
    
    // 2. Generate a secure Initialization Vector (IV)
    $ivlen = openssl_cipher_iv_length($cipher_method);
    $iv = openssl_random_pseudo_bytes($ivlen);
    
    // 3. Encrypt the data
    $ciphertext = openssl_encrypt($plaintext, $cipher_method, $encryption_key, 0, $iv);
    
    // 4. Combine IV and Ciphertext (needed for decryption) and encode
    // Format: IV::EncryptedString
    $stored_value = base64_encode($iv . '::' . $ciphertext);
    
    // 5. Overwrite the value destined for the database
    // We do NOT change $submitted_data, so the user still sees their input if validation fails elsewhere.
    $values_to_process[$index] = $stored_value;
}
?>

<?php
// Same configuration as above
$encryption_key = 'YourSuperSecretKey123!'; 
$cipher_method = "aes-256-cbc";
$field_to_decrypt = 'secret_data';

// Only run in edit mode and if data exists
if ($is_edit_mode && !empty($record_data[$field_to_decrypt])) {
    
    // 1. Decode Base64
    $raw_data = base64_decode($record_data[$field_to_decrypt]);
    
    // 2. Separate IV and Ciphertext
    if (strpos($raw_data, '::') !== false) {
        list($iv, $ciphertext) = explode('::', $raw_data, 2);
        
        // 3. Decrypt
        $decrypted_text = openssl_decrypt($ciphertext, $cipher_method, $encryption_key, 0, $iv);
        
        // 4. Inject back into the record data array
        // The form renderer will now display this decrypted value.
        if ($decrypted_text !== false) {
            $record_data[$field_to_decrypt] = $decrypted_text;
        }
    }
}
?>