Need suggestion for highscore

[MadDawgX]

Hey,

 

I have a flash game set up and a highscore table. I have it setup so upon completion of the game the user submits his/her score and it POSTS the data to a php file where it is added to the database.

 

The problem is, it's not very secure. When submitted the user can refresh the page so that it adds the score again. Im also certain there are other insecurities with the system.

 

So, I need suggestions on how I can make this as secure as possible.

 

Thanks

[Psycho]

I would suggest generating a random GUID that gets populated into a hidden field on the page that POSTs the data. Then when iserting the High Score also isert the GUID. You can then check if the GUID exists before inserting a new high score.

[PHP Monkeh]

Instead of outputting data with your submission page, you could just use it to submit the score, then forward the user to a "Thanks for submitting your score" page or whatever page you like.

 

So have your page like this:

 

// Submit the high-score to the database

header("Location: thanks.php");

 

This way when the user hits refresh it'll be  refreshing thanks.php, which isn't submitting anything.

[monkeymade]

just a thought, I don't know if this is possible the way you have the rest of your page set up, but instead of using POST or GET to send the score to the page that enters it into the high score page, use sessions.  Then after the score has been added, clear that session variable out, so if refresh is hit, the score stored in the session variable is 0 instead of their actual score.  Just an idea, hope you get something that works for you.

[MadDawgX]

Instead of outputting data with your submission page, you could just use it to submit the score, then forward the user to a "Thanks for submitting your score" page or whatever page you like.

 

So have your page like this:

 

// Submit the high-score to the database

header("Location: thanks.php");

 

This way when the user hits refresh it'll be  refreshing thanks.php, which isn't submitting anything.

 

Okay that will work.

 

Another thing, Im not sure about the securities of flash, but what if someone was able to get ahold of the link to the submitting page. Would they be able to manipulate a score? If so is there a way to prevent that?

[PHP Monkeh]

Is it possible to set hidden fields within flash?  You could add a hidden field with the value "fromFlash" or something similar.  Then on your process page make sure that the value from that field is "fromFlash", then you'd know that they've come from the flash page, and it would be safe to upload the high-score.

 

I don't really know a lot about flash to give you a better answer, sessions would've been ideal.