Thanks Ray, I figured that was the case.
mcrypt is installed (v.2.5.8) so that's good. However, I've replaced the Protx_VSPForm.php with your version (and copied the password into line 2) and changed the hidden form value from "2.23" to "3.00" but when going to Sagepay's site I get this error:
This transaction attempt has failed. We are unable to redirect you back to the web store from which you were purchasing. The details of the failure are given below.
Status Detail: 5068 : The encryption method is not supported by this protocol version.
Do you know why this is happening?