Luckily, in PHP land, I can do it wrong without ever having to type the letters A-E-S anywhere, because the relevant mcrypt constants are named MCRYPT_RIJNDAEL_128, MCRYPT_RIJNDAEL_192, and MCRYPT_RIJNDAEL_256.

Nevermind the fact that only MCRYPT_RIJNDAEL_128 is actually AES, most developers choose MCRYPT_RIJNDAEL_256 and claim they're implementing AES-256.

To wit (trigger warning, encraption and severe arrogance on its developer's behalf follows):

https://github.com/opencart/opencart/blob/99bcfb24519ef3a411...

https://github.com/opencart/opencart/issues/1279

https://github.com/opencart/opencart/issues/1594

And this is an eCommerce platform.

If anyone is feeling frustrated by the constant "don't roll your own crypto" advice from the experts, it's being said for a damn good reason.

Also, don't use opencart's encryption library.