Re: Please hack my highscore table code

digiguru@xxxxxxxxx wrote: 
I'm trying to create a highscrore table in Flash using PHP to store the
highscores in a text file on the server.

I want to make it as robust as possible without letting people whack in
their own high scores. Whats the best way of achieving this?

here is the code.

<?php
//These variables currently come from a form.
//I the future they are going to be passed via a flash movie
//I understand flash movies are easy to bust apart,
// so whats the best way of preventing people from people adding dodgy
scores?
$userName = $_POST['myName'];
$userEmailAddress = $_POST['myEmail'];
$userScore = $_POST['myScore'];

$filename = "highscores.php";
//Currently our server only accepts ".php" files, not ".txt" - which is
ANNOYING!
//The style of the text file is...
"$userName,$userEmailAddress,$userScore\n"
// for 10 to 50 lines of high scores, depending on how fast it runs.
$numScores;
$highScoreArray;

// I havn't whacked any functions in it as I believe
// each function is a key that can be used to hack, am I right?
if (!$userEmailAddress) {
	echo "error : no email address";
	exit;
} else {
	if(!file_exists( $filename )) {
		echo "error : no highscore file";
	} else {
		$highScoreArray = file ($filename);
		$numScores = count($highScoreArray);
		$fp = fopen($filename,"w");
		if(!$fp) {
			echo "error : couldn't open data file";
		} else {
			$highScoreRow = "";
			$highScoreRowBuffer = "";
			for ($i=0; $i<$numScores; $i++) {
			//loop through from the begining of the file to the end
				$highScoreRow = $highScoreArray[$i];
				$highScoreRowArray = explode (",",$highScoreRow);
				$highScore = $highScoreRowArray[2];
				// the high score is the last one in the list
				if ($highScore < ($userScore+1)) {
				//If its a new high score (I add one to give priority to newer
scores)
					if ($highScoreRowBuffer == "") {
					//This is to enter the new high score
						$highScoreArray[$i] = "$userName,$userEmailAddress,$userScore\n";
					} else {
					//This moves the previous not quite so high score to move down the
table
						$highScoreArray[$i] = $highScoreRowBuffer;
					}
					// assign the buffer to remember the highscore as it will be
moving down the list now.
					$highScoreRowBuffer = $highScoreRow;
				}
			}
			// Write to file
			for ($i=0; $i<$numScores; $i++) {
				fwrite($fp, $highScoreArray[$i]);
			}
		}
		fclose($fp);
		echo "<a href='highscores.php'>Here is the new highscores file</a>";
	}
}
// This is a code I pulled off another site to prevent hacking, should
I be using it everywhere in the page?!
function fix_for_page($value){
$value = htmlspecialchars(trim($value));
if (get_magic_quotes_gpc())
$value = stripslashes($value);
return $value;
}

?>

Could be a toughie. First of all you should transfer that data encrypted to at least throw off easy hack attempts that just send the same data from a custom header instead of the flash app.

You could use a CRC checksum value or something like it (md5hash) on the flash file itself as part of the encryption perhaps ? Or maybe import a one-time key in the Flash app at its start from your server ? Cookies ? Etc...

Just a few thoughts.
GL
Sh
.

Relevant Pages

  • Re: PWB - North Korea Kaboom
    ... Just because the high score already exists ... doesn't mean anyone can't get a new highscore and submit ... [..getting old and still playing video games..] ... Blogger - http://www.blogger.com/profile/14480997341376883177 ...
    (uk.games.video.misc)
  • Problem with displays on stern magic 1979 !! can anyone help !!
    ... stay on for approx 10 to 15 seconds flash the high score a couple of ... times then they all turn off/go blank. ...
    (rec.games.pinball)