Ultrashock Forums > Flash > Data Communication
PHP - mySQL - Flash security issues

You are currently viewing our website as a guest which gives you limited access to forums, files and other resources.

Click here to join now for free, and start interacting with our members, download files and much more!

Click here if you are looking for our Flash files and other professional assets.
 
Post Reply | View first unread | Rate Thread Search this Thread | Thread Tools | Display Modes

#1
Bookmark and Share!
PHP - mySQL - Flash security issues
Old 2008-01-02

Hi,

I am working on a simple game and hope to have an area to post high scores and names. I can get everything working locally (Flash,PHP,mySQL) but when I try to go live the .swf cant seem to find the database. I can get a remote browser to run a php script to pull items from the database and print to the page, but this fails inside of Flash.

What security issues am I overlooking? Will swfObject overcome these issues? I havent used swfObject yet.

I am still using Flash 8 and Actionscript 2.

Any suggestions would be appreciated!

Thanks.
postbit arrow 34 comments | 4057 views postbit arrow Reply: with Quote   
Registered User
monka is offline
seperator
Posts: 35
2005-03-01
monka lives in United States
seperator

Ultrashock Member Comments:
sims11tz's Avatar sims11tz sims11tz is offline sims11tz lives in United States 2008-01-02 #2 Old  
Hmmmm, nothing comes to my mind from what you said. What are more details, what is your as code that is calling the php script? Can you call your php script manually in browser and does it connect to your mysql db without any problems? Is the .swf and the php script on the same server.... more details and someone should be able to help ya I don't think swfObject will solve your problem.... but swfObject is awesome and it wouldn't be a bad idea for you to implement it either way.
Reply With Quote  
xty xty is offline xty lives in Canada 2008-01-02 #3 Old  
Hi There
Try this: http://www.amfphp.org/
Reply With Quote  
monka monka is offline monka lives in United States 2008-01-02 #4 Old  
Thank you very much for the replies. I will check out the link suggested right after this post. Additional details were requested to help identify the problem. I didnt want to overload people with stuff but here is the basic php script and Flash code I am using to post to the database. Post & retrieval of data works when testing locally from Flash but Flash does not recognize the database when tested from remote machines. The swf,html,php,and mySQL database are hosted on my machine locally that is also running a local server for testing.

PHP script====================================================

<?php
$connection = mysql_connect("localhost","root","password");
if (!$connection) {
die("Database connection failed: " . mysql_error());
}

// 2. Select a database to use
$db_select = mysql_select_db("test",$connection);
if (!$db_select) {
die("Database selection failed: " . mysql_error());
}

$message = $_POST["theName"];
$score = $_POST["theScore"];
echo ($message);

$sql = "INSERT INTO `test`.`mytable` (`id`, `name`, `score`) VALUES (NULL, '$message', '$score')";
$result = mysql_query($sql);

echo ($sql);
mysql_close($connection);
?>

FLASH ACTIONSCRIPT 2.0=========================================

var senderLoad:LoadVars = new LoadVars();

score = finalScore;
winner = winnerName;

senderLoad.theName = winner;
senderLoad.theScore = score;
senderLoad.sendAndLoad("http://localhost/php_sandbox/test3.php",senderLoad, "POST");

Reply With Quote  
monka monka is offline monka lives in United States 2008-01-02 #5 Old  
Forgot to answer this question in the previous post.

"Can you call your php script manually in browser and does it connect to your mysql db without any problems?"

I can call a php script manually from a remote browser and it will load data correctly. The only time the project fails is when trying to load data remotely from a database into Flash. Everything works fine locally. That is why I thought there must be some security issue that I am overlooking.

Thanks.
Reply With Quote  
sims11tz's Avatar sims11tz sims11tz is offline sims11tz lives in United States 2008-01-02 #6 Old  
Hmmm... that is weird. One way to get further information about what is going on is you can run charles http://www.xk72.com/charles/. If you run charles and run your website in a browser. Charles will show you when your flash piece attempted to run the php script, did it find the script and what POST vars it sent to the php script. Also it will tell you what the php script tried to send back as far as data. It might help you trap your bug.
Reply With Quote  
Nutrox's Avatar Nutrox Nutrox is offline Super Moderator Nutrox lives in United Kingdom 17 Creative Assets 2008-01-02 #7 Old  
This might be a silly question, but are you trying to access http://localhost from a live/online server?
Reply With Quote  
monka monka is offline monka lives in United States 2008-01-04 #8 Old  
It's not a siily question. Yes, I was trying to access a localhost from a live/online server. By changing this and changing the publish settings to "access network only," the project now seems to work online - partially. Everything seems to work fine in FireFox, but in IE updates fail. The initial php load scipt seems to work fine and populate the Flash text fields with data. The post script seems to work fine too, but it will not update the Flash text fields with the new data. The data gets there, but I have to close the browser and reopen it to see the updated data. This is strange because it uses the same Actionscript call and php script that the initial load uses without problem. Also, everything seems to work fine in Firefox. I checked the Flash Player version for both browsers and it is the latest install (9.0.115). I also tried using Charles as suggested. On Firefox it shows everything working fine. In IE, the php load script never gets called again after the post. This is strange because it is the same swf for both browsers. I'm not sure what is going on.

Any suggestions?
Reply With Quote  
Nutrox's Avatar Nutrox Nutrox is offline Super Moderator Nutrox lives in United Kingdom 17 Creative Assets 2008-01-04 #9 Old  
You do realise that connecting to http://localhost will only work when you are browsing your online site from you own machine? Everyone has their own localhost domain ( i.e. their machine ), so Flash is going to try and access the machine the user is using to browse your site.
Reply With Quote  
monka monka is offline monka lives in United States 2008-01-04 #10 Old  
Yeah, thanks for pointing that out so it is clear. I think I have solved that issue by uploading the project to my web host and referencing my domain name in the Flash calls. It seems to work fine in Firefox but I still get the issues in IE I mentioned in my last post.

Thanks

.
Reply With Quote  
Nutrox's Avatar Nutrox Nutrox is offline Super Moderator Nutrox lives in United Kingdom 17 Creative Assets 2008-01-04 #11 Old  
The data update problem is due to caching by the sounds of it. I have a thread in my blog that shows how to you can prevent files from being cached, doing that will force Flash to reload the file from the server each time it is requested instead of loading it from the browser's cache.

Reply With Quote  
monka monka is offline monka lives in United States 2008-01-07 #12 Old  
Thank you very much for your blog link Nutrox. The first technique worked very well for me. Now everything works well on both IE and Firefox. Thanks!
Reply With Quote  
awdio awdio is offline awdio lives in United States 2009-01-11 #13 Old  
What was the solution? I've been having a similar problem for over a week and I'm starting to go crazy.
Reply With Quote  
monka monka is offline monka lives in United States 2009-01-12 #14 Old  
Hi,

It's been awhile since this post was done but I'm looking through my files trying to find this project.
Sorry for not posting it before. I'll post the solution if I can find it.
Reply With Quote  
monka monka is offline monka lives in United States 2009-01-12 #15 Old  
I forgot I had a load/send example in my Ultrashock blog.
There is a zip file that can be downloaded with the Flash and PHP files.
Here is the link. Hope it helps.

http://www.ultrashock.com/blog/monka...ample-315.html
Reply With Quote  
bokanovski bokanovski is offline bokanovski lives in Hungary 2009-03-25 #16 Old  
omg, that link just doesnt work >.>
you said you have a solution and posted a link that aint no work at all..
Reply With Quote  
monka monka is offline monka lives in United States 2009-03-25 #17 Old  
Hi,

I'm not sure what you mean. Does the link to the post and file not work or does the example not work? I've just tried both the link and example myself again and they both seem to be working fine. Sorry you are having trouble with it. What are the issues you are having?
Reply With Quote  
bokanovski bokanovski is offline bokanovski lives in Hungary 2009-03-30 #18 Old  
Quote: Originally Posted by Nutrox View Post
The data update problem is due to caching by the sounds of it. I have a thread in my blog that shows how to you can prevent files from being cached, doing that will force Flash to reload the file from the server each time it is requested instead of loading it from the browser's cache.

i meant this link above. :/ "a thread in my blog" umm. call me noob, but i been searching for that blog, and im affraid theres no such thing at all. the links url does not lead to anywhere, and i have no idea what blog, 'cuz on the user's page, i couldnt find any link about blogs.

sorry for complaining, i dont know this site, but i thought i can find out more why that link dont work if i register. but not. anyways, thanks for respond^^
Reply With Quote  
monka monka is offline monka lives in United States 2009-03-30 #19 Old  
Oh, that was a blog post by Nutrox. Maybe he deleted that from his blog. I have the same info in the PHP files in the example on my blog entry at: http://www.ultrashock.com/blog/monka...ample-315.html

HTML Code:
http://www.ultrashock.com/blog/monka/php-load-and-send-example-315.html
This blog is part of the Ultrashock site so hopefully you can access it. The example files are in a zip file that can be downloaded from this blog entry. Hope this helps.
Reply With Quote  
monka monka is offline monka lives in United States 2009-03-30 #20 Old  
xxxxxx
Reply With Quote  
bokanovski bokanovski is offline bokanovski lives in Hungary 2009-04-01 #21 Old  
Thanks, monka, i will take a look on that, and hopefully will help me. TY
Reply With Quote  
bokanovski bokanovski is offline bokanovski lives in Hungary 2009-04-01 #22 Old  
Nope. didnt solve it.

Actually everything seems to be working, but ONLY with IE. and im using IE7, cookies enabled, running from a webserver. some kind of free stuff where i get a subdomain, but i managed to store cookies, and use them for logindata and recognisation.

The deal is that it aint no work at all under firefox -.- and i cant figure out why.

if any one look forward to this and maybe could help me, tell me and i post some code for further debugging
Reply With Quote  
Nutrox's Avatar Nutrox Nutrox is offline Super Moderator Nutrox lives in United Kingdom 17 Creative Assets 2009-04-01 #23 Old  
bokanovski, what problem are you having exactly, is it just a problem with file caching/refreshing? Also, which version of ActionScript are you using?
Reply With Quote  
monka monka is offline monka lives in United States 2009-04-01 #24 Old  
Hi Bokanovski,

Cookies and such are a bit beyond me. I was happy to get the example I have working. I'm glad Nutrox has looked at this and inquired about your problems. Thanks Nutrox
Reply With Quote  
bokanovski bokanovski is offline bokanovski lives in Hungary 2009-04-02 #25 Old  
Oh, thank you for respond. Well.
Im working with actionscript 3, publish for flash player 9, testing with flash player 10, firefox 3, IE7.

I have no idea what's the problem source is. I built up a flash site where you can register and log in, send messages to the site etc.

The flash communicates with an apach web server database. My site completly works on IE7, and even with FF, but only on localhost.

The issue (well, i think), is that the flash cant communicate with the server correctly from firefox. it does not send or recieve any data. i see the browers status bar telling that the communication started, or it trying to do something but nothing happens.

Every data transmitting form is quiet the same on my site, so i post the login box's one for short.

Here's the as for the login board, i have text fields for ID and PASS, a login and a register button, i ignored the register script we don't need for this.
http://pastie.org/434766

And here's the php 'login3.php' this fella uses:
http://pastie.org/434772

I added that no-cache script to the beginning of the php u mentioned, btu it did nothing, even i set the expire date to 2010.

This thing, as i said works well with exporer, but nothign happens under ff. I also get a "Permission denied to call method Location.toString" error at the firefox's error message board, i looked after it, but no idea yet what it means.

Hope we can work it out

Oh, btw..heres the site www.dailywisdom.atw.hu
Reply With Quote  
Nutrox's Avatar Nutrox Nutrox is offline Super Moderator Nutrox lives in United Kingdom 17 Creative Assets 2009-04-02 #26 Old  
You have errors coming out of your ears. I'm not sure why your site is working in Internet Explorer, it shouldn't be, you are running into several security sandbox problems:


Error #2044: Unhandled securityError:. text=Error #2048: Security sandbox violation: http://users.atw.hu/dailywisdom/index.swf cannot load data from http://dailywisdom.atw.hu/refreshshout.php.
at index_fla::Shoutit_39/refreshshout()
at index_fla::Shoutit_39/frame1()

Error #2044: Unhandled securityError:. text=Error #2048: Security sandbox violation: http://users.atw.hu/dailywisdom/index.swf cannot load data from http://localhost/a/login3.php.
at index_fla::tempLogIn_66/sender()


Why are you trying to access "localhost", that makes no sense at all when the SWF is running online because the localhost domain is the local computer. In other words, when I visit your site it will try to access my computer - my localhost. You need to look into crossdomain policy files if you want the SWF file to access data on a different domain than the one it is running in. There a loads of threads around Ultrashock about crossdomain files, basically you need to create a file called "crossdomain.xml" and put it in the root directory of the "dailywidsom.atm.hu" domain, the contents of that XML file should look something like this:

Code:
<?xml version="1.0" encoding="UTF-8"?>
<cross-domain-policy>
	<site-control permitted-cross-domain-policies="master-only"/>
	<allow-access-from domain="*.atw.hu"/>
	<allow-http-request-headers-from domain="*.atw.hu" headers="*"/>
</cross-domain-policy>
Reply With Quote  
bokanovski bokanovski is offline bokanovski lives in Hungary 2009-04-02 #27 Old  
ah, yes well..correct question, but i uploaded a test version which set to access localhost, not the server's phps...im gonna upload the correct swf. sorry.

Edit: Done. try it now. apology. it works for me now.

the other error->no idea :s
Reply With Quote  
Nutrox's Avatar Nutrox Nutrox is offline Super Moderator Nutrox lives in United Kingdom 17 Creative Assets 2009-04-02 #28 Old  
You are getting the errors because you haven't setup a crossdomain policy file as I mentioned in my last reply.


Error #2044: Unhandled securityError:. text=Error #2048: Security sandbox violation: http://users.atw.hu/dailywisdom/index.swf cannot load data from http://dailywisdom.atw.hu/refreshshout.php.
at index_fla::Shoutit_39/refreshshout()
at index_fla::Shoutit_39/frame1()

Error #2044: Unhandled securityError:. text=Error #2048: Security sandbox violation: http://users.atw.hu/dailywisdom/index.swf cannot load data from http://dailywisdom.atw.hu/login3.php.
at index_fla::tempLogIn_66/sender()
Reply With Quote  
bokanovski bokanovski is offline bokanovski lives in Hungary 2009-04-02 #29 Old  
OK, well i placed a file with the wxact same content and file name on the root where i have acces, which is my subdomain at atw.hu -> named dailywisdom.atw.hu
i also read after crossdomain xml thingies, but i still dont get how to use it.

do i only have to store it, or may call this file somewhere in any script? does anything should refer to is, or is it enough to put it where it belongs?

bEsides.
i dont think im trying to access any other sites, flash only communicates to the exact same place where it is...ok, i read that flash can send data to server, but can't recieve from it, due to security issues they built into the player. but..maybe some more advice could do the trick, and i also would appreciatet it, thank you
Reply With Quote  
Nutrox's Avatar Nutrox Nutrox is offline Super Moderator Nutrox lives in United Kingdom 17 Creative Assets 2009-04-02 #30 Old  
The crossdomain file is in the correct place ( http://dailywisdom.atw.hu/crossdomain.xml ) and that is all you need to do, Flash will check for the file automatically. However... your server is wrapping that XML file in a frameset so Flash is not going to be able to access/read the crossdomain file.

If you can't disable that frameset then I suggest you find a better server provider for yourself.
Reply With Quote  
bokanovski bokanovski is offline bokanovski lives in Hungary 2009-04-02 #31 Old  
omg, thank you, you helped me a lot ) well i thought that these free services are ****..
i already purchased an own url and found a free web server, maybe that will solve it
Thank you again, hope i wont have any problems in the future.
Reply With Quote  
Nutrox's Avatar Nutrox Nutrox is offline Super Moderator Nutrox lives in United Kingdom 17 Creative Assets 2009-04-02 #32 Old  
No problem, bokanovski.
Reply With Quote  
geck0 geck0 is offline geck0 lives in United Kingdom 2009-06-18 #33 Old  
dude im having exact same problem as monka....where can i see this example .zip? to try get the issue sorted...ahh its doing my head in!!
Reply With Quote  
geck0 geck0 is offline geck0 lives in United Kingdom 2009-06-18 #34 Old  
right i have sorted the data going into the flash now, but my problem occurs when i go to update the exisitng data?
Reply With Quote  
geck0 geck0 is offline geck0 lives in United Kingdom 2009-06-18 #35 Old  
Last edited by geck0 : 2009-06-18 at 02:48.
locally the update runs fine: and updates my db currently live.
but when i play the game on the server the query wont seem to update

here is my flash code:
newPlayer = "edd";
whatToDo = "submitScore";
loadVariablesNum("http://www.keuda.co.uk/streetcrime/get_scores.php", 0, "POST");
gotoAndPlay("sending"); //progress timeline
and php code:

if ($whatToDo == "submitScore"){


$newScore = $_POST['newScore'];
$newPlayer = $_POST['newPlayer'];
$lowestHighScore = $_POST['lowestHighScore'];

mysql_connect ($host, $user, $pass);
mysql_select_db ($database);

$insertScore = "UPDATE $table SET score = $newScore WHERE player = '$newPlayer'";
mysql_query($insertScore);
echo "&scoresUpdated=true";

}
it seems that i am not getting the return value of scoreUpdated? as a few frames after the update I have code but my flash just keeps looping sending?:

if (scoresUpdated == undefined){ //waits for scoresUpdated to be defined

gotoAndPlay("sending");

} else if (scoresUpdated == true){ //if scoresUpdated == true, data was sent to the server.

gotoAndPlay(1); // goes back to frame 1 and displays the updated score

}
Reply With Quote  
Thread Tools
Display Modes Rate This Thread
Rate This Thread: