<?php

function xor_encrypt($text, $key) {
    $outText = '';

    // Iterate through each character
    for($i=0;$i<strlen($text);$i++) {
        $outText .= $text[$i] ^ $key[$i % strlen($key)];
    }

    return $outText;
}

function decodeData($data, $key) {
    return json_decode(xor_encrypt(base64_decode($data), $key), true); 
}

function encodeData($data, $key) {
    return base64_encode(xor_encrypt(json_encode($data), $key));
}

function encodeData2($data, $key) {
    return base64_encode(xor_encrypt($data, $key));
}

function xstrings($s1, $s2) {
    if (strlen($s1) != strlen($s2)) {
        print 'Strings must be equal in length!';
        return;
    }
    $res = '';
    for($i = 0; $i < strlen($s1); $i++) {
        $res .= $s1[$i] ^ $s2[$i];
    }
    echo $res."\n";
    echo bin2hex($res)."\n";
}

// finding out the key
xstrings(base64_decode("ClVLIh4ASCsCBE8lAxMacFMZV2hdVVotEhhUJQNVAmhSEV4sFxFeaAw="),
                     json_encode(array( "showpassword"=>"no", "bgcolor"=>"#ffffff")));
// the above function outputs
// qw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jq
// 7177384a7177384a7177384a7177384a7177384a7177384a7177384a7177384a7177384a7177384a71
// we can easily see that the xor key must be 'qw8J'

$key = 'qw8J';
// generate the new data with the key
echo 'Submit the following as the "data" cookie to gain access: '.encodeData(array("showpassword"=>"yes", "bgcolor"=>"#ffffff"), $key)."\n";

?>