people hacking high score game

[lsatdown]

I created a game in as2 a while back which saves scores to a mysql db via a asp file. I've found out people are hacking and pushing in high scores.
I did a bit of research and did a calculation on the high score in flash, then the reverus of that in asp, then if they match save to the database, but I still think people are hacking it.
Any tips on making this stop!??!

[Canazza]

you may be able to use
$_SERVER[ 'HTTP_REFERER' ]
to see where they're sending the post from, although there are plugins that can modify headers so there is a chance that it will still be hacked, but they would have to be more determined

[lsatdown]

yeah I tried that and realised people can still modify it!

[Canazza]

you can be a sneaky cheat however, use a second (invisible) flash movie embeded on the page and contact it through a local connection.
keep your sending code in the main one but send it to a 'pretend' web page, and really instead send the localconnection your score and have the second one send your score up.
Once you've done that you could think about obfuscating the code using a flash encrypter, it'll keep the url in your code, big and blatant for people to see, and the lazy ones will take that, try it and it won't work.

it's security through obscurity which sadly, is a limitation of flash.

[abseeley]

yea red herrings are a great way to catch cheaters, just throw like 50 of them in, the best way i find to work with highscores is mad nazi encryption. Encrypt your scores HEAVY send them to the server in plain site, and make sure you use a changing encryption so its like based on the time/name/score which is easier to play the game then to crack, as long as you can decrypt it server side its all good. in my past experience this works great