function CasualPassword($lenght=527){
    $available_chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890";
    $password = "";
    for($i = 0; $i<$lenght; $i++){
        $password .= substr($available_chars,rand(0,strlen($available_chars)-1),1);
    }
    return $password;
  }
$key = CasualPassword();
$string = nl2br($_POST['nota']);
for ($i = 0; $i < strlen($string); $i++ ) {
   $temp = $string[$i] ^ $key[$i % strlen($key)];
   $crypt .= str_pad( dechex( ord( $temp ) ), 2, 0, STR_PAD_LEFT);
}
$encryptednote = $key.'__'.$crypt;

$separate = explode("__",$encryptednote);
$key =$separate[0];
$crypt = $separate[1];
$cnt = 0;
for ($i = 0; $i < strlen( $crypt ); $i+=2){
    $temp = chr( hexdec( substr( $crypt, $i, 2) ) );
    $string .= $temp ^ $key[$cnt % strlen($key)];
    $cnt++;
}

<?php
include("../co.php");
include("config.php");
if($_GET['del']!="" and is_numeric($_GET['del'])){
  $user = addslashes($_SESSION['user']);
  $drop = "DELETE FROM notes WHERE id='".$_GET['del']."' and username='".$user."'";
mysqli_query($connect,$drop);
$_SESSION['download']="0";
$_SESSION['downloaded']="";
echo '<script>
$("#princ").html("Note deleted.");
 $("#princ").load("../includes/note.php", function (responseText, textStatus, req) {
   if (textStatus == "error") {
      $("#princ").html("An error occurred");
   }
});
  setTimeout(function() {
$("#note").load("../includes/note.php?load=true", function (responseText, textStatus, req) {
   if (textStatus == "error") {
      $("#princ").html("An error occurred");
   }
});
}, 10000);
 </script>';
die();
}
if($_POST['nota']!=""){//critta e inserisci nel db
  function CasualPassword($lenght=527){
    $available_chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890";
    $password = "";
    for($i = 0; $i<$lenght; $i++){
        $password .= substr($available_chars,rand(0,strlen($available_chars)-1),1);
    }
    return $password;
  }
$key = CasualPassword();
$string = nl2br($_POST['nota']);
for ($i = 0; $i < strlen($string); $i++ ) {
   $temp = $string[$i] ^ $key[$i % strlen($key)];
   $crypt .= str_pad( dechex( ord( $temp ) ), 2, 0, STR_PAD_LEFT);
}
$encryptednote = $key.'__'.$crypt;
$query = "INSERT INTO  `notes` (
`username` ,
`nota`
)
VALUES (
'$user',  '$encryptednote'
);";
mysqli_query($connect,$query);
$_SESSION['download']="0";
$_SESSION['downloaded']="";
echo '<script>
 $("#note").html("Loading...");
 $("#note").load("../includes/note.php?load=true", function (responseText, textStatus, req) {
   if (textStatus == "error") {
      $("#princ").html("An error occurred.");
   }
});
 function update() {
  $.get("../includes/note.php?load=true", function(data) {
    $("#note").html(data);
  });
}
window.setTimeout(update, 3000);
 </script>';
}
else if($_POST['nota']=="" and $_GET['load']==""){echo '<script>
$(document).ready(function() {
  $("#go").click(function(){
  $("#note").html("Please wait...");
$.ajax({
url:"../includes/note.php",
type: "POST",
data: $("#notes").serialize(),
   success: function(msg)
      {
        $("#note").html(msg);
      },
      error: function()
      {
        alert("Error!");
      }
    });
  });
});
 $("#note").html("Loading...");
 $("#note").load("../includes/note.php?load=true", function (responseText, textStatus, req) {
   if (textStatus == "error") {
      $("#princ").html("An error occurred.");
   }
});
function update() {
  $.get("../includes/note.php?load=true", function(data) {
    $("#note").html(data);
  });
}
</script>
<form method="post" action="../includes/note.php" id="notes">
<textarea name="nota" id="nota" style="width:100%; height:20%;"></textarea>
<input type="button" id="go" value="Save">
</form>';}
if($_GET['load']=="true"){echo '<h3>Your notes</h3>';
//seleziona tutte le note
  $user = addslashes($_SESSION['user']);
  $download = addslashes($_SESSION['download']);
$query = mysqli_query($connect,"SELECT * FROM notes WHERE username='".$user."' AND id>'".$download."' ORDER BY id DESC LIMIT 0,50");
while($note = mysqli_fetch_assoc($query)){
$separate = explode("__",$encryptednote);
$key =$separate[0];
$crypt = $separate[1];
$cnt = 0;
for ($i = 0; $i < strlen( $crypt ); $i+=2){
    $temp = chr( hexdec( substr( $crypt, $i, 2) ) );
    $string .= $temp ^ $key[$cnt % strlen($key)];
    $cnt++;
}
echo $string.'<br><button class="opzione" id="elimina'.$note['id'].'" onclick="$('#elimina'.$note['id'].'').hide(); $('#confermaz'.$note['id'].'').show();">Delete</button><button class="opzione" id="confermaz'.$note['id'].'" style="display:none;"><a href="javascript:apriLink('../includes/note.php?del='.$note['id'].'')">Confirm</a></button><hr>';
if($note['id']>$_SESSION['download'] or $_SESSION['download']==""){$_SESSION['download']=$note['id'];}
$_SESSION['downloaded'] .= $stringa.'<br><button class="opzione" id="elimina'.$note['id'].'" onclick="$('#elimina'.$note['id'].'').hide(); $('#confermaz'.$note['id'].'').show();">Delete</button><button class="opzione" id="confermaz'.$note['id'].'" style="display:none;"><a href="javascript:apriLink('../includes/note.php?del='.$note['id'].'')">Confirm</a></button><hr>';
$stringa="";
}
echo $_SESSION['downloaded'];
echo '<script>
window.setTimeout(update, 3000); </script>';
die();
}
?>
<div id="note"></div>

$drop = "DELETE FROM notes WHERE id='".$_GET['del']."' and username='".$user."'";

$query = "INSERT INTO  `notes` (
[...]

echo $string

"# === WARNING ===

# Resulting cipher text has no integrity or authenticity added
# and is not protected against padding oracle attacks."

    private function setupCipher(){
        $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);

        return array(
            pack('H*', "bcb04b7e103a0cd8b54763051cef08bc55abe029fdebae5e1d417e2ffb2a00a3"),
            $iv_size,
            mcrypt_create_iv($iv_size, MCRYPT_RAND)
        );
    }

    public function decrypt($string){
        list($key, $iv_size) = $this->setupCipher();

        $string = base64_decode($string);
        $iv_dec = substr($string, 0, $iv_size);
        $ciphertext_dec = substr($string, $iv_size);
        return trim(mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $ciphertext_dec, MCRYPT_MODE_CBC, $iv_dec), "");
    }

    public function encrypt($string) {
        list($key, $iv_size, $iv) = $this->setupCipher();

        $string = $iv . mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $string, MCRYPT_MODE_CBC, $iv);
        return trim(base64_encode($string), "");
    }