Basic High/Low

[The Monk]

[align=center]The Monk's High/Low Mod for MCCodes V2

[/align]

I was searching through the requests section and I found an old topic, high/low seemed easy enough.

This is the first mod I made from scratch.

I'll try to update this in the future and might release a paid premium version.

 

You're unable to view this code.

Viewing code within this forum requires registration, you can register here for free.

 

[mysql]CREATE TABLE IF NOT EXISTS `highlow` (

`userid` int(11) NOT NULL,

`oldnum` int(11) NOT NULL,

PRIMARY KEY (`userid`)

) ENGINE=MyISAM DEFAULT CHARSET=latin1;[/mysql]

A couple comments here and there to explain the point of some things.

I'd love input/feedback, feel free to tear it up and re-post your 'better' version.

Update 1: Secured querys + variables to the best of my knowledge.

Update 2.1: Added support for MySQL table, removed hidden input editing vuln.

Update 2.2: Re-secured in everything to use less processing power.

[Equinox]

Nice attempt, but I advise you to look into securing your scripts....

[The Monk]

Feel free to point me in the right direction, even just by telling me what the result of the security flaw would be.

[Equinox]

Well, security flaws can do a lot - in an McCodes game, users could manipulate the data you're sending to their own benefit and they could insert malicious data to destroy your script and site.

[Joshua]

I did a quick run through and secured the few things i saw, nothing major.

Good job, we need some guys to start making mods again, keeps the forums alive :)

 

You're unable to view this code.

Viewing code within this forum requires registration, you can register here for free.

[Rasheed saeed]

@Josh:

I think <center> is deprecated. Also a few $_POSTS[''] are un-secure. :)

[Joshua]

$_POST['choice'] is the only post not secure and there is nothing really to my knowledge that can be done with that variable anywho so shrugz.

<center> will work fine enough it's his code i just tightened it up a bit.

[Joshua]

I'm not to great with Javascript the only thing that I could possibly imagine could be done with $_POST['choice'] variable would be some sort of javascript attack, but it's not inserting anything into the database so I dont think it would be manageable.

Just the same, I'll "secure" that post variable to, to appease the masses.

[Djkanna]

Um what about checking whether the bet is one of those dropdown options specified?

$bet = number_format(rand(1,10));

Is a bad idea considering you use $bet in the form then when altering the users money via a query.

So UPDATE `users` SET `money` = `money` - 10,000 ...........

if(10,000 > $ir['money']) {

[Joshua]

Oh yeh $bet is inserting to the $db-> good catch.

I spose could use a basic if not in array function for making sure the bet is one specified, but again, i dont see what anyone could do with it

[Joshua]

Post updated just for you Dj :P

[Djkanna]

Oh yeh $bet is inserting to the $db-> good catch.

I spose could use a basic if not in array function for making sure the bet is one specified, but again, i dont see what anyone could do with it

Bet more than what's specified?

I know not much of a security issue but it's a deflect in how it was intended to work therefore a bug :D

[Joshua]

On a side note

It's a $_POST variable not a get variable, so manipulating the variable in anyway is a lot more difficult.

[Joshua]

n/m

[Djkanna]

Open Firebug or Google Chromes version and bang edited.

[Joshua]

Fixed either way ^_-

[Djkanna]

You'll need to give the demo some cash..

[Joshua]

yep, done.

[Djkanna]

Problem only half fixed though :P

Congratulations! You won your bet of \$1

You guessed high, the previous number was 2 and the new number was 7.

Is the next number going to be higher or lower than 7?

(meh I just signed up and mugged a dude with some cash) :D

Just to note I started with 11k and now I have

Money: $24,666,602

I can always win no matter what, change the old num hidden value to one and always click higher ensures a win each time (also changing my bet makes it easier to gain quick cash

Congratulations! You won your bet of \$110000000

You guessed high, the previous number was 1 and the new number was 6.

Is the next number going to be higher or lower than 6?

Also make sure to check if I have enough money on the higher and lower aswell otherwise you get

Congratulations! You won your bet of \$1100000000000000000000

You guessed high, the previous number was 1 and the new number was 3.

Is the next number going to be higher or lower than 3?

I don't have that kind of cash.

[Joshua]

Well hrmz.

Maybe because i secured the post but not the $bet variable which he's using for the calls

 

You're unable to view this code.

Viewing code within this forum requires registration, you can register here for free.

[Joshua]

I mass credited everyone for cash lol

[Djkanna]

A few minutes and my money is already maxed out

Name: Djkanna [4]

Money: $2,147,483,647

Congratulations! You won your bet of \$1100000055555555555555555555555555555555555555555500000000000000

You guessed high, the previous number was 1 and the new number was 6.

Is the next number going to be higher or lower than 6?

[Joshua]

May have helped if i had inserted the updated code on-line i suppose >,<

[Djkanna]

Hehe only need to check the hidden values and you're sorted.

[peterisgb]

hmm good mod, but just a little query, i dont know much about coding but adding cards in would like be better.

the code here

You're unable to view this code.

Viewing code within this forum requires registration, you can register here for free.

 

could like this be added to make the cards show,

if ($guess == 1 { print ""; } else

if ($guess == 2 { print ""; } else

if ($guess == 3 { print ""; }

etc, would that work or not??