Please hack my highscore table code



I'm trying to create a highscrore table in Flash using PHP to store the
highscores in a text file on the server.

I want to make it as robust as possible without letting people whack in
their own high scores. Whats the best way of achieving this?

here is the code.

<?php
//These variables currently come from a form.
//I the future they are going to be passed via a flash movie
//I understand flash movies are easy to bust apart,
// so whats the best way of preventing people from people adding dodgy
scores?
$userName = $_POST['myName'];
$userEmailAddress = $_POST['myEmail'];
$userScore = $_POST['myScore'];

$filename = "highscores.php";
//Currently our server only accepts ".php" files, not ".txt" - which is
ANNOYING!
//The style of the text file is...
"$userName,$userEmailAddress,$userScore\n"
// for 10 to 50 lines of high scores, depending on how fast it runs.
$numScores;
$highScoreArray;

// I havn't whacked any functions in it as I believe
// each function is a key that can be used to hack, am I right?
if (!$userEmailAddress) {
echo "error : no email address";
exit;
} else {
if(!file_exists( $filename )) {
echo "error : no highscore file";
} else {
$highScoreArray = file ($filename);
$numScores = count($highScoreArray);
$fp = fopen($filename,"w");
if(!$fp) {
echo "error : couldn't open data file";
} else {
$highScoreRow = "";
$highScoreRowBuffer = "";
for ($i=0; $i<$numScores; $i++) {
//loop through from the begining of the file to the end
$highScoreRow = $highScoreArray[$i];
$highScoreRowArray = explode (",",$highScoreRow);
$highScore = $highScoreRowArray[2];
// the high score is the last one in the list
if ($highScore < ($userScore+1)) {
//If its a new high score (I add one to give priority to newer
scores)
if ($highScoreRowBuffer == "") {
//This is to enter the new high score
$highScoreArray[$i] = "$userName,$userEmailAddress,$userScore\n";
} else {
//This moves the previous not quite so high score to move down the
table
$highScoreArray[$i] = $highScoreRowBuffer;
}
// assign the buffer to remember the highscore as it will be
moving down the list now.
$highScoreRowBuffer = $highScoreRow;
}
}
// Write to file
for ($i=0; $i<$numScores; $i++) {
fwrite($fp, $highScoreArray[$i]);
}
}
fclose($fp);
echo "<a href='highscores.php'>Here is the new highscores file</a>";
}
}
// This is a code I pulled off another site to prevent hacking, should
I be using it everywhere in the page?!
function fix_for_page($value){
$value = htmlspecialchars(trim($value));
if (get_magic_quotes_gpc())
$value = stripslashes($value);
return $value;
}

?>

.