EllisLab/CodeIgniter — pull request #2736 by sarciszewski (2013-11-21 01:16:08+00:00)
Title: Security++; Traumatic_Backwards_Incompatibility--;

Based on the conversation here:
https://github.com/EllisLab/CodeIgniter/pull/2735

Less incompatibility but still enhances security. Complete list of changes:
* Added OpenSSL support (if it exists)
* Instead of silently falling back to XOR encrypting when mcrypt isn't available, Encrypt will try to use OpenSSL instead. If PHP < 5.3, it will still use XOR (but not silently) for compatibility
* Added ::hmac() method; feel free to exclude it if you have no need for it
* get_key() will return raw SHA-256 instead of hex-encoded MD5; if you pass a second optional boolean parameter, it will use the old (and much less secure) legacy md5($key) method