Hey, cool project. As another poster in this thread mentioned, you have a cross-site scripting vulnerability because you don't properly sanitize the decrypted user input.

I might work on this if I get a little time later today, but in case I don't, here are a few resources for you:

http://stackoverflow.com/questions/3129899/what-are-the-comm...

https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%...

The good news is that PHP is so widespread that there are really great tutorials and libraries for sanitizing user input and preventing cross-site scripting.

Good luck!

Is there a written description of the protocol used between the client and server anywhere?