refresh cheating.

[Torniquet]

ok. well as we all know, refreshing a page after submitting data to the DB can cause major issues. (esspecially when purchasing items in a game and basically cheating)

i know alot of this can be stopped by running a series of checks before allowing the transaction and data to be written to the DB.

but running checks will not always produce a solution.

for eg. you buy something from a shop, while the databse is farting about, the page crashes and you are left with a blank screen (failed to load, slow internet. what ever the cause may be... it happens)

now to the average person, their 1st instinct is to hit f5/refresh button.

this will cause a double entry on the db without the user wanting to, and therefor purchasing twice the amount of stuff he wanted to buy.

now in my case, i run all my checks via ajax/jQuery before you are able to purchase the item.

one thing i struggled to do was to prevent the above without running needless checks against the player, and without header'ing to another page where the user would have to mess about navigating back to the shop to make another purchase, rinsing and repeating asmany times as they wanted to purchase all of their stuff.

well i have come up witha quick fix. (how secure it really is. i dont honestly know lol) But it seems to work for now lol.

what i do, via Jquery, is to load up a page when the buy button is clicked, which sets a session, then asoon as the page is loaded again, it unsets the session. by doing this and checking to make sure the session is set before any DB manipulation happens. i am stopping anyone refreshing and making multiple purchases, either on purpus or not.

quick break down of the code.

Code: Select all

<?php
if(isset($_POST['buy'])){
  if(isset($_SESSION['confirmBuy'])){
  unset($_SESSION['confirmBuy'];
  Rest of code!!
  }
}
?>

<input type='image' id='buybutton'>

<script type='text/javascript'>
$('#buybutton').click(function(){
load('sessionset.php');
});
</script>

setsession.php

Code: Select all

<?php
session_start();
$_SESSION['confirmBuy'] = "set";
?>

and all Should work from there on out.


if anyone has any alternative methods to doing this. please feel free to post them.

[Jackolantern]

What I did was make two session variables called something like "stopRefresh1" and "stopRefresh2" which each hold a number between 1 - 30,000. Whenever an action occurs that you would not want the player to repeat by refreshing (either to avoid cheating, or players accidentally doing things twice), you create a random number between 1 and 30,000 and store it in the first variable. Then in the processing of the action, check to make sure that the second variable is not equal to the first. Provided it is not, then actually do the calculations for the action and then store the contents of the second variable in the first. That way, if the page is refreshed, the variables will be the same and the check will fail, which signals to you to not repeat the action again.

[hallsofvallhalla]

very good ideas!

[Falken]

What I did was make two session variables called something like "stopRefresh1" and "stopRefresh2" which each hold a number between 1 - 30,000. Whenever an action occurs that you would not want the player to repeat by refreshing (either to avoid cheating, or players accidentally doing things twice), you create a random number between 1 and 30,000 and store it in the first variable. Then in the processing of the action, check to make sure that the second variable is not equal to the first. Provided it is not, then actually do the calculations for the action and then store the contents of the second variable in the first. That way, if the page is refreshed, the variables will be the same and the check will fail, which signals to you to not repeat the action again.

Althought you have a 1 in 9*10^8 chance of randoming the 2 numbers in a row...and then someone would get really pissed

Cheating can in many cases be prevented by having a good code structure, and relevant checks before anything is written to the DB.

Also doing your checks in the javascript code is never a good idea! Then the user can just choose "view source", check what php page is being called, and enter that URL in the browser directly.

[Jackolantern]

What I did was make two session variables called something like "stopRefresh1" and "stopRefresh2" which each hold a number between 1 - 30,000. Whenever an action occurs that you would not want the player to repeat by refreshing (either to avoid cheating, or players accidentally doing things twice), you create a random number between 1 and 30,000 and store it in the first variable. Then in the processing of the action, check to make sure that the second variable is not equal to the first. Provided it is not, then actually do the calculations for the action and then store the contents of the second variable in the first. That way, if the page is refreshed, the variables will be the same and the check will fail, which signals to you to not repeat the action again.

Althought you have a 1 in 9*10^8 chance of randoming the 2 numbers in a row...and then someone would get really pissed

Cheating can in many cases be prevented by having a good code structure, and relevant checks before anything is written to the DB.

Also doing your checks in the javascript code is never a good idea! Then the user can just choose "view source", check what php page is being called, and enter that URL in the browser directly.

I'll take those chances

However, I am sure there is probably a more elegant way of handling the issue. I am definitely not a PHP master, but this method has worked great for my game so far.

[Torniquet]

Also doing your checks in the javascript code is never a good idea! Then the user can just choose "view source", check what php page is being called, and enter that URL in the browser directly.

you are quite right.

i am yet to bury the session set code, but providing it is burried enough it would be a pain to find. and unless someone knows how the game is accually blocking the refresh cheat then they would be looking for a baby pin in a 10ft haystack tbh.

as for the checks, variables are being posted to the other page, and only echos results out. there for directly inputing in the addy would be about as pointless as chips and icecream. if they can somehow manipulate the page which checks info they can manipulate it in a normal check.

providing a set of results are not echoed, then the buy button appears, which you need to use to buy something. and the enter button is disabled so you cannot submit a form just by pressing enter.

P.S for anyone who wishes to know how to disable it.

Code: Select all

<form onkeypress='return event.keyCode!=13'>
</form>

tis elementary dr watson