AJAX Email Obfuscator

sendmail.php:
<?php
    include('safemail.php');
    echo $tocode->decrypt($_GET['id']);
?>

safemail.php:
<?php
        class Cipher {
                private $securekey, $iv;
                function __construct() {
                        $this->securekey = hash('sha256','<secret>',TRUE);
                        $this->iv = mcrypt_create_iv(32);
                }
                function encrypt($input) {
                        return base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256,$this->securekey, $input, MCRYPT_MODE_ECB, $this->iv));
                }
                function decrypt($input) {
                        return trim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256,
                                        $this->securekey, base64_decode($input),MCRYPT_MODE_ECB, $this->iv));
                }
        }

        $tocode = new Cipher();

        function linkemail($email,$title=FALSE) {
                global $tocode;
                return "<a title=\"".($title?$title:"Retrieve email")."\" rel=\"safemail_".$tocode->encrypt($email)."\">".($title?$title:"Send email")."</a>";
        }
?>

site.js:
function addFormEvent(func) {
        if (!document.getElementById | !document.getElementsByTagName)
                return;

        var oldonload=window.onload;
        if (typeof window.onload != 'function') {
                window.onload=func;
        } else {
                window.onload=function() {
                        oldonload();
                        func();
                }
        }
}

function safeMail() {
        if (!document.getElementsByTagName)
                return;
        var tags = document.getElementsByTagName("a");
        for (var i=0; i<tags.length; i++) {
                if (tags[i].getAttribute("rel")) {
                        if (tags[i].getAttribute("rel").substr(0,8) == "safemail") {
                                var id = tags[i].getAttribute("rel").substr(9);
                                sendRequest('/sendmail.php?id='+id,handleRequest,tags[i]);
                        }
                }
        }
}

function sendRequest(url,callback,target,postData) {
        var req = createXMLHTTPObject();
        if (!req) return;
        var method = (postData) ? "POST" : "GET";
        req.open(method,url,true);
        req.setRequestHeader('User-Agent','XMLHTTP/1.0');
        if (postData)
                req.setRequestHeader('Content-type','application/x-www-form-urlencoded');
        req.onreadystatechange = function () {
                if (req.readyState != 4) return;
                if (req.status != 200 && req.status != 304) {
                        return;
                }
                callback(req,target);
        }
        if (req.readyState == 4) return;
        req.send(postData);
}

var XMLHttpFactories = [
        function () {return new XMLHttpRequest()},
        function () {return new ActiveXObject("Msxml2.XMLHTTP")},
        function () {return new ActiveXObject("Msxml3.XMLHTTP")},
        function () {return new ActiveXObject("Microsoft.XMLHTTP")}
];

function createXMLHTTPObject() {
        var xmlhttp = false;
        for (var i=0;i<XMLHttpFactories.length;i++) {
                try {
                        xmlhttp = XMLHttpFactories[i]();
                }
                catch (e) {
                        continue;
                }
                break;
        }
        return xmlhttp;
}

function handleRequest(req,target) {
        target.target = "_blank";
        target.href = "mailto:"+req.responseText;
        target.innerHTML = req.responseText;
}

addFormEvent(safeMail);