Take the 2-minute tour ×

I have to make connection to the DB and Insert a row based on the data that the SWF sent me...

I will need to make it so that the SWF->PHP part is secure by not letting users tamper with data.

I don't want to use SSL because its not a suitable solution... what other method is available?

share|improve this question
This question is way too broad. You need to build good interfaces to prevent users from tampering with data. SSL and encryption are no help there at all - they just make the connection between user and system secure. You'll need to show what you do, and ask in more detail about the interactions that take place –  Pekka 웃 Oct 23 '10 at 11:48
For example, a flash game... It sends a score to PHP to be recorded. The score shouldn't be tampered with or it becomes unfair. –  Melina Oct 23 '10 at 11:50
possible duplicate of Suggestions for (semi) securing high-scores in Flash/PHP game... –  Paul Dixon Oct 23 '10 at 11:55
Sorry, i wasn't good at searching i guess, i couldnt find anything related to hiscores –  Melina Oct 23 '10 at 12:24
Check this out for some ideas: stackoverflow.com/questions/73947/… –  Juan Pablo Califano Oct 23 '10 at 14:53

4 Answers 4

The firefox plugin TamperData can manipulate any request sent by the browser regardless of https.

To make sure the message wasn't modified on the wire you can use an HMAC. The secret key K can be packaged with the flash application and a flash obfuscater can be used. However, this is security though obscurity and any hacker with an afternoon to kill will be able to fool this system. However this is the best that you can do.

share|improve this answer
  1. Encode data in client with private key.
  2. Send it to php server
  3. Decode data in php and add it to database

OR Make all the possible and use HTTPS / SSL

share|improve this answer
Pirvulescu. SSL does not add any security here. SSL secures the channel (meaning, it prevents a third party from sniffing the client/server conversation). It does not prevent one party from tampering the exchanged data. –  Juan Pablo Califano Nov 3 '10 at 3:21

You may have luck with AMFPHP. Quoted from the SourceForge page:


While no method is foolproof, I tend to lean toward this - or making socket connections to a local socket server which then handles database interaction.

share|improve this answer

Send a salted hash of the serialized data you are sending. Then check that key on the server. This again whilst not foolproof will help stop 99% of your fraud.

Also make sure you encrypt your swf so the hash salt and salting method can not be exposed.

share|improve this answer

Your Answer


