1

I have to make connection to the DB and Insert a row based on the data that the SWF sent me...

I will need to make it so that the SWF->PHP part is secure by not letting users tamper with data.

I don't want to use SSL because its not a suitable solution... what other method is available?

Improve this question
8
  • This question is way too broad. You need to build good interfaces to prevent users from tampering with data. SSL and encryption are no help there at all - they just make the connection between user and system secure. You'll need to show what you do, and ask in more detail about the interactions that take place Commented Oct 23, 2010 at 11:48
  • For example, a flash game... It sends a score to PHP to be recorded. The score shouldn't be tampered with or it becomes unfair. Commented Oct 23, 2010 at 11:50
  • possible duplicate of Suggestions for (semi) securing high-scores in Flash/PHP game... Commented Oct 23, 2010 at 11:55
  • Sorry, i wasn't good at searching i guess, i couldnt find anything related to hiscores Commented Oct 23, 2010 at 12:24
  • Check this out for some ideas: stackoverflow.com/questions/73947/… Commented Oct 23, 2010 at 14:53

4 Answers 4

Reset to default
1

The firefox plugin TamperData can manipulate any request sent by the browser regardless of https.

To make sure the message wasn't modified on the wire you can use an HMAC. The secret key K can be packaged with the flash application and a flash obfuscater can be used. However, this is security though obscurity and any hacker with an afternoon to kill will be able to fool this system. However this is the best that you can do.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

0
  1. Encode data in client with private key.
  2. Send it to php server
  3. Decode data in php and add it to database

OR Make all the possible and use HTTPS / SSL

Improve this answer

1 Comment

Pirvulescu. SSL does not add any security here. SSL secures the channel (meaning, it prevents a third party from sniffing the client/server conversation). It does not prevent one party from tampering the exchanged data.
0

You may have luck with AMFPHP. Quoted from the SourceForge page:

"AMF allows for binary serialization of Action Script (AS2, AS3) native types and objects to be sent to server side services."

While no method is foolproof, I tend to lean toward this - or making socket connections to a local socket server which then handles database interaction.

Improve this answer

Comments

0

Send a salted hash of the serialized data you are sending. Then check that key on the server. This again whilst not foolproof will help stop 99% of your fraud.

Also make sure you encrypt your swf so the hash salt and salting method can not be exposed.

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.