Scoreboard help!

programming flash
1

Hi All, Thanks for your time.

Basically I’ve set up a scoreboard for a flash game that I’ve made for a client. Now the scoreboard works fine but apparently it’s not very secure. One of the clients friends was able to add a score of 100,000 without even playing the game. This is quite a big problem as they are planning on doing a competition with prizes for the highest scores. So he suggested I encrypt it, however I zero experience with encrypition and I’m really struggling with it.

I emailed the guy who was able to hack it and he replied to me with this:

[INDENT]There isn’t much you can do in terms of fully securing it, but for the length of this campaign I believe any basic encrypting algorithm would be sufficient.

I was able to add a score by monitoring the connections made by the game to send the score at the end of play. i.e. the game sends this data:-
[LIST]
[]situation
[]score
[]email
[]location
[]age
[]name
[/LIST]All of these can be spoofed in a request to the register.php to create a faked high score.

Could you add a final parameter to the data which will hash (using SHA-1 algorithm) all previous parameters with a set extra secret key. Something like this:-
[LIST]
[]Parameters = ‘situation=???&score=???&email=???&location=???&age=???&name=???’
[]SHA-1 of parameters with ‘&keepmoatpacmansecrettext’ appended to it
[]Send the parameters with the hash added to them
[LIST]
[]situation
[]score
[]email
[]location
[]age
[]name
[]hash
[/LIST]
[/LIST]as3corelib looks like it does the job (com.adobe.crypto.SHA1)

[/INDENT]

I’m in way over my head basically and don’t understand the majority of what he is saying. Also I’m using as2 so I don’t think “as3corelib” will work.

Here’s the code I’m using to send the data to php:


player = new LoadVars();
playerRegistered = new LoadVars();
playerRegistered.onLoad = showResult;


_root.scoreSubmitted = false;


submit.onRelease = submitScore;


function submitScore():Void {


    var index:Number;


    if(!_root.scoreSubmitted) {
        _root.scoreSubmitted = true;
        player.name = origName;
        player.age = age_txt.text;
        player.location = location_txt.text;
        player.email = email_txt.text;
        player.score = score_txt.text;
        player.situation = situation_txt.text;
        player.sendAndLoad("register.php",playerRegistered);
    }
}
function showResult():Void {
    message_txt.text = this.error;
    message_txt.text = this.message;
    score_txt.text = "";
    _root.play();
    _root.submitScoreBox.removeMovieClip();
}

And here’s register.php:



<?php


$connect = mysql_connect('------', '---------', '--------');
mysql_select_db('--------', $connect);


$sql = 'INSERT INTO users (name,score,email,age,location,situation) VALUES ("'.$_POST['name'].'","'.$_POST['score'].'","'.$_POST['email'].'","'.$_POST['age'].'","'.$_POST['location'].'","'.$_POST['situation'].'")';


$result = mysql_query($sql);


if($result) {
    $created = 'Score posted for '.$_POST['name'];
    echo 'message='.urlencode($created);
}
?>

Please help me!!

Any help you could give me about what he is referring to in the email would be a great help.

TIA
McCoy