# Scoreboard help!

**URL:** <https://forum.kirupa.com/t/scoreboard-help/325514>\
**Category:** flash\
**Created:** [October 19, 2011, 10:46pm UTC](https://forum.kirupa.com/t/scoreboard-help/325514 "2011-10-19T22:46:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BadBoyMcCoy](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@BadBoyMcCoy](https://forum.kirupa.com/u/BadBoyMcCoy)\
**Post date:** [October 19, 2011, 10:46pm UTC](https://forum.kirupa.com/t/scoreboard-help/325514/1 "2011-10-19T22:46:11Z")

</div>

Hi All, Thanks for your time.

Basically I’ve set up a scoreboard for a flash game that I’ve made for a client. Now the scoreboard works fine but apparently it’s not very secure. One of the clients friends was able to add a score of 100,000 without even playing the game. This is quite a big problem as they are planning on doing a competition with prizes for the highest scores. So he suggested I encrypt it, however I zero experience with encrypition and I’m really struggling with it.

I emailed the guy who was able to hack it and he replied to me with this:

[INDENT]There isn’t much you can do in terms of fully securing it, but for the length of this campaign I believe any basic encrypting algorithm would be sufficient.

I was able to add a score by monitoring the connections made by the game to send the score at the end of play. i.e. the game sends this data:-  
[LIST]  
[_]situation  
[_]score  
[_]email  
[_]location  
[_]age  
[_]name  
[/LIST]All of these can be spoofed in a request to the register.php to create a faked high score.

Could you add a final parameter to the data which will hash (using SHA-1 algorithm) all previous parameters with a set extra secret key. Something like this:-  
[LIST]  
[_]Parameters = ‘situation=???&score=???&email=???&location=???&age=???&name=???’  
[_]SHA-1 of parameters with ‘&keepmoatpacmansecrettext’ appended to it  
[_]Send the parameters with the hash added to them  
[LIST]  
[_]situation  
[_]score  
[_]email  
[_]location  
[_]age  
[_]name  
[_]hash  
[/LIST]  
[/LIST]as3corelib looks like it does the job (com.adobe.crypto.SHA1)

[/INDENT]

I’m in way over my head basically and don’t understand the majority of what he is saying. Also I’m using as2 so I don’t think “as3corelib” will work.

Here’s the code I’m using to send the data to php:

```auto

player = new LoadVars();
playerRegistered = new LoadVars();
playerRegistered.onLoad = showResult;

_root.scoreSubmitted = false;

submit.onRelease = submitScore;

function submitScore():Void {

    var index:Number;

    if(!_root.scoreSubmitted) {
        _root.scoreSubmitted = true;
        player.name = origName;
        player.age = age_txt.text;
        player.location = location_txt.text;
        player.email = email_txt.text;
        player.score = score_txt.text;
        player.situation = situation_txt.text;
        player.sendAndLoad("register.php",playerRegistered);
    }
}
function showResult():Void {
    message_txt.text = this.error;
    message_txt.text = this.message;
    score_txt.text = "";
    _root.play();
    _root.submitScoreBox.removeMovieClip();
}

```

And here’s register.php:

```auto

<?php

$connect = mysql_connect('------', '---------', '--------');
mysql_select_db('--------', $connect);

$sql = 'INSERT INTO users (name,score,email,age,location,situation) VALUES ("'.$_POST['name'].'","'.$_POST['score'].'","'.$_POST['email'].'","'.$_POST['age'].'","'.$_POST['location'].'","'.$_POST['situation'].'")';

$result = mysql_query($sql);

if($result) {
    $created = 'Score posted for '.$_POST['name'];
    echo 'message='.urlencode($created);
}
?>

```

Please help me!!

Any help you could give me about what he is referring to in the email would be a great help.

TIA  
McCoy