How to protect SQL run through PHP by Javascript Post function

Question

I have a little HTML5 game on my website that executes a Javascript function every time the game ends. The function is in an external script:

SubmitScore:(Gets called by game script)

function ONLINE_submitScore(strName,intMs) {
    intMs = Math.round(intMs);
    result = SQLCommand("online2.php?act=submit&name="+strName+"&score="+intMs);
    return result;
 }

SQLCommand: next to be called

function SQLCommand(url){
    ajax=AjaxCaller();
    if(ajax==false)
        alert("AjaxCaller() failed!");
    ajax.open("GET", url, true); 
    ajax.onreadystatechange=function(){
        if(ajax.readyState==4){
            if(ajax.status==200){
                return ajax.responseText;
            }
        }
    }
    ajax.send(null);
}

AjaxCaller: Final function called

function AjaxCaller(){
    var xmlhttp=false;
    try{
        xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
    }catch(e){
        try{
            xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
        }catch(E){
            xmlhttp = false;
        }
    }
    if(!xmlhttp && typeof XMLHttpRequest!='undefined'){
        xmlhttp = new XMLHttpRequest();
    }
    return xmlhttp;
}

The problem that I've encountered is that someone can easily use the developer console in Chrome or Firefox and execute the Javascript ONLINE_submitScore function to enter whatever score they please. What can I do to prevent this? Using a server-side password doesn't work because it's easy to see the POST request to read the password client-side.

joshstrike · Accepted Answer · 2015-05-11 05:28:46Z

If you don't have a login system that uses a one-way encrypted password, then there's no way to prevent anyone from putting in any score they want, as many times as they want to. At some point, of course, your high score board is just an open pipe to your database and anyone can spoof any value they want into it. Adding a login system and password you can limit the number of times a user tries to add a score - but you really have no way to check it. Yes, maybe you could write a crazy verification thing that happens within your game, and then gets replayed and checked on the backend (I don't know how your game works) but if someone wants to they can still probably fake a score.

[FWIW casinos work by running all results on the backend but casual/action mobile apps just don't work that way, the game takes place on the user's phone. Just obfuscate and make it harder for them to figure out how to spoof your system]

[Like, also a good starting point would be to not include a super-well-laid-out plan of a PHP file that I can hit from my browser to add a high score. Consider encoding that as part of a big gnarly random file you send up and then decoding it on the PHP side or something.]

Malay M · Accepted Answer · 2015-05-11 05:28:02Z

0

Can you use CSRF in your form. Here is an example http://www.wikihow.com/Prevent-Cross-Site-Request-Forgery-(CSRF)-Attacks-in-PHP

answered May 11, 2015 at 5:28

Malay M

1,7691 gold badge14 silver badges22 bronze badges

Collectives™ on Stack Overflow

How to protect SQL run through PHP by Javascript Post function

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related