Please hack my highscore table code
- From: digiguru@xxxxxxxxx
- Date: 28 Sep 2005 03:05:26 -0700
I'm trying to create a highscrore table in Flash using PHP to store the
highscores in a text file on the server.
I want to make it as robust as possible without letting people whack in
their own high scores. Whats the best way of achieving this?
here is the code.
<?php
//These variables currently come from a form.
//I the future they are going to be passed via a flash movie
//I understand flash movies are easy to bust apart,
// so whats the best way of preventing people from people adding dodgy
scores?
$userName = $_POST['myName'];
$userEmailAddress = $_POST['myEmail'];
$userScore = $_POST['myScore'];
$filename = "highscores.php";
//Currently our server only accepts ".php" files, not ".txt" - which is
ANNOYING!
//The style of the text file is...
"$userName,$userEmailAddress,$userScore\n"
// for 10 to 50 lines of high scores, depending on how fast it runs.
$numScores;
$highScoreArray;
// I havn't whacked any functions in it as I believe
// each function is a key that can be used to hack, am I right?
if (!$userEmailAddress) {
echo "error : no email address";
exit;
} else {
if(!file_exists( $filename )) {
echo "error : no highscore file";
} else {
$highScoreArray = file ($filename);
$numScores = count($highScoreArray);
$fp = fopen($filename,"w");
if(!$fp) {
echo "error : couldn't open data file";
} else {
$highScoreRow = "";
$highScoreRowBuffer = "";
for ($i=0; $i<$numScores; $i++) {
//loop through from the begining of the file to the end
$highScoreRow = $highScoreArray[$i];
$highScoreRowArray = explode (",",$highScoreRow);
$highScore = $highScoreRowArray[2];
// the high score is the last one in the list
if ($highScore < ($userScore+1)) {
//If its a new high score (I add one to give priority to newer
scores)
if ($highScoreRowBuffer == "") {
//This is to enter the new high score
$highScoreArray[$i] = "$userName,$userEmailAddress,$userScore\n";
} else {
//This moves the previous not quite so high score to move down the
table
$highScoreArray[$i] = $highScoreRowBuffer;
}
// assign the buffer to remember the highscore as it will be
moving down the list now.
$highScoreRowBuffer = $highScoreRow;
}
}
// Write to file
for ($i=0; $i<$numScores; $i++) {
fwrite($fp, $highScoreArray[$i]);
}
}
fclose($fp);
echo "<a href='highscores.php'>Here is the new highscores file</a>";
}
}
// This is a code I pulled off another site to prevent hacking, should
I be using it everywhere in the page?!
function fix_for_page($value){
$value = htmlspecialchars(trim($value));
if (get_magic_quotes_gpc())
$value = stripslashes($value);
return $value;
}
?>
.
- Follow-Ups:
- Re: Please hack my highscore table code
- From: Schraalhans Keukenmeester
- Re: Please hack my highscore table code
- Prev by Date: Re: Coding style: PHP with Complex MySQL statements
- Next by Date: PHP Mail() and Exchange Server
- Previous by thread: How to login to htaccess box
- Next by thread: Re: Please hack my highscore table code
- Index(es):