CODEWITHSUNDEEP
javascriptphpjquerysecuritypost
htmlhigh5
htmlhigh5

Reputation: 59

How to protect SQL run through PHP by Javascript Post function

I have a little HTML5 game on my website that executes a Javascript function every time the game ends. The function is in an external script:

SubmitScore:(Gets called by game script)

function ONLINE_submitScore(strName,intMs) {
    intMs = Math.round(intMs);
    result = SQLCommand("online2.php?act=submit&name="+strName+"&score="+intMs);
    return result;
 }

SQLCommand: next to be called

function SQLCommand(url){
    ajax=AjaxCaller();
    if(ajax==false)
        alert("AjaxCaller() failed!");
    ajax.open("GET", url, true); 
    ajax.onreadystatechange=function(){
        if(ajax.readyState==4){
            if(ajax.status==200){
                return ajax.responseText;
            }
        }
    }
    ajax.send(null);
}

AjaxCaller: Final function called

function AjaxCaller(){
    var xmlhttp=false;
    try{
        xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
    }catch(e){
        try{
            xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
        }catch(E){
            xmlhttp = false;
        }
    }
    if(!xmlhttp && typeof XMLHttpRequest!='undefined'){
        xmlhttp = new XMLHttpRequest();
    }
    return xmlhttp;
}

The problem that I've encountered is that someone can easily use the developer console in Chrome or Firefox and execute the Javascript ONLINE_submitScore function to enter whatever score they please. What can I do to prevent this? Using a server-side password doesn't work because it's easy to see the POST request to read the password client-side.

Upvotes: 0

Views: 56

Answers (2)

joshstrike
joshstrike

Reputation: 1823

If you don't have a login system that uses a one-way encrypted password, then there's no way to prevent anyone from putting in any score they want, as many times as they want to. At some point, of course, your high score board is just an open pipe to your database and anyone can spoof any value they want into it. Adding a login system and password you can limit the number of times a user tries to add a score - but you really have no way to check it. Yes, maybe you could write a crazy verification thing that happens within your game, and then gets replayed and checked on the backend (I don't know how your game works) but if someone wants to they can still probably fake a score.

[FWIW casinos work by running all results on the backend but casual/action mobile apps just don't work that way, the game takes place on the user's phone. Just obfuscate and make it harder for them to figure out how to spoof your system]

[Like, also a good starting point would be to not include a super-well-laid-out plan of a PHP file that I can hit from my browser to add a high score. Consider encoding that as part of a big gnarly random file you send up and then decoding it on the PHP side or something.]

Upvotes: 1

Malay M
Malay M

Reputation: 1759

Can you use CSRF in your form. Here is an example http://www.wikihow.com/Prevent-Cross-Site-Request-Forgery-(CSRF)-Attacks-in-PHP

Upvotes: 0

Related Questions