MySQL in flash??? Are they just asking for trouble.

arpace · 12-11-2005, 06:12 PM

Unless the code for an swf file is secured and cannot be decompiled, which is not bloody likely, all of the calls to the db will be accessable to the would-be hacker.

If you put your authentication information in the swf, you have just given the entire world permission to hack your db.

The server side authentication is still needed to prevent information theft and corruption; however, if they ever figure out a way to secure the swf from being decompiled, and still give the performace the world expects, I will be the first to say hooray.

Flash Gordon · 12-11-2005, 06:57 PM

this is in the wrong section probably....
Also, you have the idea all wrong............
Flash can not connect to a database, period! only server side scripts can. no one (probably) is going to hack your php/asp scripts. php then tells flash what the database said.

Cota · 12-11-2005, 09:49 PM

It is the wrong section...also, on a side note, the server-side script can be exploited as well, which is why people use DLL's and COM objects to actually house the SQL, and protect against injection attacks.

Headshotz · 12-16-2005, 02:38 AM

Damn hackers, trying to be so hacky.

hangalot · 12-17-2005, 01:43 PM

Quote:

Originally Posted by Flash Gordon

this is in the wrong section probably....
Also, you have the idea all wrong............
Flash can not connect to a database, period! only server side scripts can. no one (probably) is going to hack your php/asp scripts. php then tells flash what the database said.

i think with AS3 this is possible actually since you can connect to different ports and read and push binary streams. so if you understand the protocol involved it is doable.

Headshotz · 12-18-2005, 09:17 AM

Now the hackers have hacked my AS.org password they can make heaps of senseless posts and advertise for products, oh wait I do that anyway.

sunnylachuck · 03-27-2006, 08:29 PM

Quote:

Originally Posted by arpace

Unless the code for an swf file is secured and cannot be decompiled, which is not bloody likely, all of the calls to the db will be accessable to the would-be hacker.

If you put your authentication information in the swf, you have just given the entire world permission to hack your db.

The server side authentication is still needed to prevent information theft and corruption; however, if they ever figure out a way to secure the swf from being decompiled, and still give the performace the world expects, I will be the first to say hooray.

Do not put username and passwords in your SWF. If you need to query a passworded database then require user to enter a username/password via a form AND use an https connection.

Flash Gordon · 03-27-2006, 09:32 PM

Quote:

Originally Posted by hangalot

i think with AS3 this is possible actually since you can connect to different ports and read and push binary streams. so if you understand the protocol involved it is doable.

Man, as 3.0 must be a beast. with this a getSoundSpectrum functions. Can't wait.

hangalot · 03-28-2006, 01:57 AM

as3 is a nice beast, one i am spending my free time to the extent that i am going to get my @ss dumped. seriously though i think the boundries have been moved drastically.

ps FG is see barn's website is a link on your footer, is that an ever so unsubtle dig at ON?

Flash Gordon · 03-28-2006, 02:19 AM

Hm....I'd rather let that go.

But in all honestly, he does have a very nice site. And is very generous with his source files. I learned how to use nested loops from his site! It actually is favorite of mine.

But back to the original question: If AS 3.0 can connect to a database and it is a client side application, are people who program for that in for a world of hurt? As i understand it, I would never put any passwords or sentive data in my flash app. Any thoughts?

12-11-2005, 06:12 PM	#1
arpace I must have ADHD Join Date: Oct 2004 Location: Toronto Posts: 128	DB calls in flash??? Are they just asking for trouble. Unless the code for an swf file is secured and cannot be decompiled, which is not bloody likely, all of the calls to the db will be accessable to the would-be hacker. If you put your authentication information in the swf, you have just given the entire world permission to hack your db. The server side authentication is still needed to prevent information theft and corruption; however, if they ever figure out a way to secure the swf from being decompiled, and still give the performace the world expects, I will be the first to say hooray. __________________ Article: Day 1 at FITC ...nifty posts... Flash 8 video encoder installation fix ...............totally OT.................. Environmentally friendly house cleaning in Toronto for only $18.00 per hour. They clean my place, do a great job, and the rate is great, so I said I would help them get noticed if I could. Last edited by arpace; 12-11-2005 at 06:33 PM..

12-11-2005, 06:57 PM	#2
Flash Gordon rather be programming Join Date: Feb 2005 Location: City of Angels Posts: 10,000	this is in the wrong section probably.... Also, you have the idea all wrong............ Flash can *not* connect to a database, period! only server side scripts can. no one (probably) is going to hack your php/asp scripts. php then tells flash what the database said. __________________ I'm old enough to know better and young enough to do it anyway. -- maskedman

12-11-2005, 09:49 PM	#3
Cota Super Moderator Join Date: Jul 2001 Location: NYC Posts: 10,026	It is the wrong section...also, on a side note, the server-side script can be exploited as well, which is why people use DLL's and COM objects to actually house the SQL, and protect against injection attacks. __________________ Color Wars™ \| (kul′ər wôrs) n. - Open conflict between factions. www.theColorWars.com cota - www.chadworkman.com \| http://shavedplatypus.com occupation: designer \| flash developer \| server-side developer (php, asp, mssql, mysql)

12-16-2005, 02:38 AM	#4
Headshotz TEAM INTERNET Join Date: Jul 2005 Location: Batcave Posts: 2,759	Damn hackers, trying to be so hacky. __________________ The author of windows file copy dialogue visits some friends: "I'm just outside of town so I should be there in about 15 minutes" "Actually it's looking more like 6 days" "No, wait, 30 seconds"

12-18-2005, 09:17 AM	#6
Headshotz TEAM INTERNET Join Date: Jul 2005 Location: Batcave Posts: 2,759	Now the hackers have hacked my AS.org password they can make heaps of senseless posts and advertise for products, oh wait I do that anyway. __________________ The author of windows file copy dialogue visits some friends: "I'm just outside of town so I should be there in about 15 minutes" "Actually it's looking more like 6 days" "No, wait, 30 seconds"


<a href='http://d1.openx.org/ck.php?n=ac86e9f0&cb=INSERT_RANDOM_NUMBER_HERE' target='_blank'><img src='http://d1.openx.org/avw.php?zoneid=36053&source=_blank&cb=INSERT_RANDOM_NUMBER_HERE&n=ac86e9f0' border='0' alt='' /></a>

03-28-2006, 01:57 AM	#9
hangalot lala Join Date: Feb 2002 Location: on the road Posts: 2,859	as3 is a nice beast, one i am spending my free time to the extent that i am going to get my @ss dumped. seriously though i think the boundries have been moved drastically. ps FG is see barn's website is a link on your footer, is that an ever so unsubtle dig at ON? __________________ oi poloi http://www.memorphic.com/news/

03-28-2006, 02:19 AM	#10
Flash Gordon rather be programming Join Date: Feb 2005 Location: City of Angels Posts: 10,000	Hm....I'd rather let that go. But in all honestly, he does have a very nice site. And is very generous with his source files. I learned how to use nested loops from his site! It actually is favorite of mine. But back to the original question: If AS 3.0 can connect to a database and it is a client side application, are people who program for that in for a world of hurt? As i understand it, I would never put any passwords or sentive data in my flash app. Any thoughts? __________________ I'm old enough to know better and young enough to do it anyway. -- maskedman

Thread Tools
Show Printable Version Email this Page
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread:

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Variables passed in getURL in Flash not recognized by MySQL query	mlkarie	ActionScript 1.0 (and below)	6	10-22-2004 10:34 AM
Flash MX Developers Exam	VitiminJ	General Chat	34	05-05-2004 02:27 PM
Help regarding Flash , PHP , MySQL but Flash as a Projector File and No Browser Needs	mahendrakalkura	Server-Side Scripting	1	04-13-2002 03:32 PM
Php, Javascript, and Flash 5 browser detect and more!	Redline01	Server-Side Scripting	2	08-11-2001 02:09 AM