Scriptplayground Network

The topic of security in PHP is a long standing one in the developer community. Often times you will find security is simply overlooked. The most recent example (that I found) is the Untraceable movie web site interactive puzzle game. Once you complete the game your time and name is entered into the database to be displayed on the high score screen.

Here is an example of that easy to modify URL (removed the full path)

http://…/score.php?score=02%3A41&name=JAMES%20B%2E

As you can see the time and username are clearly visible in the URL, which in this example is 2 minutes & 41 seconds.

Now that you can see the issue, lets look at how to stop this basic modification ability. This example will use ActionScript 3 and the MD5 library provided by Adobe’s AS3CoreLib.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

import com.adobe.crypto.MD5;
 
var salt:String = "439df098";
 
function sendScore(name:String, score:String):void
{
  var scoreHash:String = MD5.hash(salt + score);
 
  var query:String = "?n=" + name +
    "&s=" + score +
    "hash=" + scoreHash;
 
  var req:URLRequest = new URLRequest("score.php" + query);
  var urlLoader:URLLoader = new URLLoader();
  urlLoader.addEventListener(Event.COMPLETE, scoreSent);
  urlLoader.load(req);
}
 
sendScore("James", "2:41");

Once the ActionScript is developed, the next step is to work out the PHP.

The PHP will take the same salt (which would be private) and test the hash to determine if the entry is valid.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

<?php
 
// connection to database goes here
 
$salt = "439df098";
 
$name = $_GET['n'];
$score = $_GET['s'];
$hash = $_GET['hash'];
 
if($hash == md5($salt + $score))
{
  // Valid score submission.
  // enter score in database at this point.
}
else
{
  // error, log IP address for security purposes
}
 
?>

As you can see this code is not very advanced, but easily protects your score submitting or any type of form submission from fraudulent entries.

I noticed a posting on Slashdot (/.) about Flash Flash Vulnerabilities that have been disclosed by a private group and some other security experts. The article in itself is not the most shocking thing, but more importantly the last line of it.

No patch in sight from Adobe, that’s the price to pay for depending on proprietary solutions.”

There is not merit or fact behind this comment, it is purely a jab at Adobe or any “proprietary” company for not adopting open solutions. Well guess what, I am all for Open Source (use it daily) but some things should stay the way they are. It is very common for someone to say Open Source is more secure but that has been proven to be a damn myth, yet people still say it…

This brings up a very good question. Would you want your bank system running on Open Source technology that anyone could look at??

Back to the Flash portion of the article, it is a serious issue, but I am sure Adobe is on top of it (aside from the fact of the holiday season).

… be cautious of what you believe to be fact, especially when the article makes numerous references to a book that is set to hit shelves in the next few weeks…