Webshop Tampering

[theeliter]

Hello Guys. Btw my name is Matthy.

 

i come here to ask for tips about my script.

 

Well this is easy. but i am so weak and no knowledge about this. look at this

    if($rows>0) {
        $rows=mssql_fetch_assoc($result); 
        extract($rows);
        
        $UserPoint = ($UserPoint);
        $ID = ($Username);
        $Usernum = ($UserNum);

    if($UserPoint<$Price) {
            echo "<font color=red size=2><center>Sorry not enough Credits to Avail this Item.<p>";
            $error = 1; delayedrefresh('webshop.php');
        }
    if($Price <= 0) {
            echo "<font color=red size=2><center>Tampering Detected<p>";
            $error = 1; delayedrefresh('webshop.php');
        }
    $result1=mssql_query("SELECT ItemStock FROM Ranshop.dbo.ShopItemMap Where ProductNum = '$ItemNum'");
    $rows1=mssql_num_rows($result1);
    if ($rows1>0) {
    $rows1=mssql_fetch_assoc($result1); 
    extract($rows1);

    $ItemStock = ($ItemStock);
    $ItemMoney = ($ItemMoney);
    $PurPrice = $_POST['PurPrice'];
    $ItemMoney = $_POST['ItemMoney'];

 

i have problem about this

because someone use Data Tampering to change the value of price. so ive put if($Price <= 0) {.

but its still not effective.because when they still change to 1-999. its still can

 

any idea guys what the best way to prevent changing price on Data Tamper to this script

 

thank you

[RussellReal]

don't send the price in the request.. send the item id number.. then you pull that id from the database, and get the price from teh database, if you've secured your sql theres no way he/she can alter those values, so you can definately rely on them..

[theeliter]

^

^

Yeah its safe if the price is on DB only.but how about Item ID.

If the Item ID is still Changable. they can get expensive item by purchasing cheap item and change the item IDit into expensive item ID.

 

so what would you suggest bro?

 

Heres a Screenie

 

[pkedpker]

all itemId's should be put with price in database.. nothing should be displayed thats not in database.. when someone submits a new item to sell.. they submit the new item ID and price to database. there is no way that you can temper that data.

 

what your doing right now is how paypal donation system works.. where a person can put any amount he wants and it puts that in the database