# Top 10 problem!

**URL:** <https://forum.kirupa.com/t/top-10-problem/44016>\
**Category:** Uncategorized\
**Created:** [February 28, 2004, 1:09am UTC](https://forum.kirupa.com/t/top-10-problem/44016 "2004-02-28T01:09:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![donkei](https://avatars.discourse-cdn.com/v4/letter/d/a183cd/32.png) [@donkei](https://forum.kirupa.com/u/donkei)\
**Post date:** [February 28, 2004, 1:09am UTC](https://forum.kirupa.com/t/top-10-problem/44016/1 "2004-02-28T01:09:17Z")

</div>

Pliz help me to resolve the problems of my Top 10 list. Yesterday someone hacked my top 10 n entered an impossible score with name “careless, i still can hack this”

Where’s the hole n how to fix it?  
Here’s the address:  
[http://donkei.com/games/yoe/hard.htm](http://donkei.com/games/yoe/hard.htm)

I got the original script from [flashkit.com](http://flashkit.com) n have modified a bit.

Pliz help 🙂

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/kirupa/original/3X/6/2/621e5c11736f46532526e61be85940af4230f3e5.png) [@system](https://forum.kirupa.com/u/system)\
**Post date:** [March 11, 2004, 3:45pm UTC](https://forum.kirupa.com/t/top-10-problem/44016/2 "2004-03-11T15:45:42Z")

</div>

I’m not a php or actionscript expert by any means, but one PHP security measure is to place important files in the root directory, above the web direcory on a server. That way you are not able to just type in a web address and go there.

I was thinking that you could keep your high score PHP file where it is on your server, but maybe you can include a file that’s in the root directory. That file could have a password check of sorts, but I’m not sure that this would help, 'cause the file will be included weather or not that script os called from flash or elsewhere.

I do know that hackers can download your php script to see the contents, but if you include a file in the protected way I mentioned in the first paragraph, it’s not web-downloadable. If that makes sense.

There must be a good way to do this because I’ve seen quite a few web applications developed in Flash that take things like username/passwords and even credit card info. Possibly you could do a search in that direction.

Good luck!