isnt that a bit dangerous ? i mean the way it look like is that moosock get to the PHP file then the php file use GET method to get the information from moosock. But if someone do find out the URL where the application go (where moosock call).. he is going to be able to do what he want ?
isnt that a bit dangerous ? i mean the way it look like is that moosock get to the PHP file then the php file use GET method to get the information from moosock. But if someone do find out the URL where the application go (where moosock call).. he is going to be able to do what he want ?
To me, connecting directly to an SQL server is the only thing that sounds really dangerous. The very purpose of the php script, is the protection between the client (the game), and the sql database.
With php, it should be no problem at all. Even if someone finds out the url, the script should of course only allow a very few types of operations, never give complete access to the database, for anyone who enters. For example, if an user has registred an account, with an username and encrypted password, even if he heads directly to the url, he will only be able change things about his own account anyway, since he don't know the other user's passwords. And if you worry about someone registering tons of accounts, remember that the very same thing can happen over a web forum anyway. And the php script can have protection against that.
How safe it is, will be completely determined by the users php programming skills. A direct connection to an SQL database, doesn't sound safe under any circumstances. In that case, the user will just be able to look at what data was used to connect to the database, use that information to connect from another client, and change lots of things...
To me, connecting directly to an SQL server is the only thing that sounds really dangerous. The very purpose of the php script, is the protection between the client (the game), and the sql database.
With php, it should be no problem at all. Even if someone finds out the url, the script should of course only allow a very few types of operations, never give complete access to the database, for anyone who enters. For example, if an user has registred an account, with an username and encrypted password, even if he heads directly to the url, he will only be able change things about his own account anyway, since he don't know the other user's passwords. And if you worry about someone registering tons of accounts, remember that the very same thing can happen over a web forum anyway. And the php script can have protection against that.
How safe it is, will be completely determined by the users php programming skills. A direct connection to an SQL database, doesn't sound safe under any circumstances. In that case, the user will just be able to look at what data was used to connect to the database, use that information to connect from another client, and change lots of things...
or you could be sneaky and host your OWN server, or get a dedicated / shared server and host the game SERVER exe on it, then the client contacts the MOOd which will get data from MySQL directly, this is in both MMORPGs i am working on
or you could be sneaky and host your OWN server, or get a dedicated / shared server and host the game SERVER exe on it, then the client contacts the MOOd which will get data from MySQL directly, this is in both MMORPGs i am working on
This system is interesting.. but is there a way.. to only enable MooSock access to the php file ? and exclude external access?
This system is interesting.. but is there a way.. to only enable MooSock access to the php file ? and exclude external access?
Have a check on the submitted data, perhaps using an MD5 hash or other hash.
If the hash fails to match discard all the data and exit the script as you know its tampered with.
Have a check on the submitted data, perhaps using an MD5 hash or other hash.
If the hash fails to match discard all the data and exit the script as you know its tampered with.
Posting Permissions
Reply With Quote