如何让php更加安全

时间:2016-06-24 00:25:33

标签: javascript php mysql unity3d

我希望使用php更新数据库中的表。我正在使用php开发一个统一的游戏来检索和更新数据。每个用户使用他们的FB详细信息登录(使用FB API的正确方法),但是现在用户名是唯一的int ID和需要更新的 sc 列。

以下是一个链接示例:http://www.mydomain.co.za/php/myphp2.php?id=1&sc=“1,2”

PHP代码(myphp2.php):

<?php

require_once('/home/########/public_html/php/mysqli_connect.php');
$id = $_GET['id'];
$selected_cards = $_GET['sc'];

$query = "UPDATE PlayerCards SET SelectedCards=$selected_cards WHERE ID=$id";

$response = @mysqli_query($dbc, $query);

if($response){
    echo 'Updated the sc of the selected id';

} else {
    echo 'could not execute database query 2';
}
?>

这样我就可以使用浏览器更新任何用户的 sc 值。 (大问题)

以下是Unity的C#脚本,用于检索我将在数据库中用来存储值的facebook用户的登录ID:

FB_manager.cs :(包含数据的脚本)

using UnityEngine;
using UnityEngine.UI;
using System.Collections;
using System.Collections.Generic;
using Facebook.Unity;


public class FB_manager : MonoBehaviour {

    private static FB_manager _instance;

    public static FB_manager Instance
    {
        get {
            if(_instance == null){
                GameObject fbm = new GameObject("FBManager");
                fbm.AddComponent<FB_manager>();
            }

            return _instance;
        }
    }

    public bool IsLoggedIn {get; set;}
    public string ProfileName {get; set;}
    public Sprite ProfilePic {get; set;}
    public string ProfileEmail {get; set;}

    void Awake()
    {
        DontDestroyOnLoad(this.gameObject);
        _instance = this;
    }

    public void InitFB(){
        if (!FB.IsInitialized) {
            // Initialize the Facebook SDK
            FB.Init(InitCallback, OnHideUnity);
        } else {
            IsLoggedIn = FB.IsLoggedIn;
        }
    }

    private void InitCallback()
    {
        if (FB.IsInitialized) {
            Debug.Log("FB is logged in");
            GetProfile();
            FB.ActivateApp();
        } else {
            Debug.Log("FB not logged in");
        }

         IsLoggedIn = FB.IsLoggedIn;

    }

    private void OnHideUnity(bool isGameShown)
    {
        if (!isGameShown) {
            // Pause the game - we will need to hide
            Time.timeScale = 0;
        } else {
            // Resume the game - we're getting focus again
            Time.timeScale = 1;
        }
    }

    public void GetProfile(){
        FB.API("/me?fields=first_name",HttpMethod.GET, DisplayUserName);
        FB.API("/me/picture?type=square&height=128&&widht=128",HttpMethod.GET,             DisplayProfilePic);
        FB.API("/me?fields=email",HttpMethod.GET, DisplayUserEmail);
    }

    void DisplayUserName(IResult result){

        if(result.Error == null){
            ProfileName = "" + result.ResultDictionary["first_name"];
        } else {
            Debug.Log(result.Error);
        }

    }

    void DisplayUserEmail(IResult result){

        if(result.Error == null){
            Debug.Log(result);
            ProfileEmail = "" + result.ResultDictionary["id"];
        } else {
            Debug.Log(result.Error);
        }

    }

    void DisplayProfilePic(IGraphResult result){

        if(result.Texture != null){
            ProfilePic = Sprite.Create(result.Texture, new Rect(0,0,128,128), new Vector2());
        } else {
            Debug.Log(result.Error);
        }

    }
}

FB_script.cs :(包含数据的脚本)

using UnityEngine;
using UnityEngine.UI;
using System.Collections;
using System.Collections.Generic;
using Facebook.Unity;

public class FB_script : MonoBehaviour {

    public GameObject DialogLoggedIn;
    public GameObject DialogLoggedOut;
    public GameObject logInStatusLabel;
    public GameObject Name;
    public GameObject ProfilePic;

    void Awake()
    {
        FB_manager.Instance.InitFB();
        HandleMenu(FB.IsLoggedIn);
    }

    public void FBLogin() {
        var perms = new List<string>() { "public_profile", "email",     "user_friends", "publish_actions"};
        FB.LogInWithReadPermissions(perms, AuthCallback);
    }

    private void AuthCallback(ILoginResult result)
    {
        if (FB.IsLoggedIn) {
            HandleMenu(FB.IsLoggedIn);
            Debug.Log("User logged in");
            FB_manager.Instance.IsLoggedIn = true;
            FB_manager.Instance.GetProfile();
            // AccessToken class will have session details
            var aToken = Facebook.Unity.AccessToken.CurrentAccessToken;
            // Print current access token's User ID
            Debug.Log(aToken.UserId);
            // Print current access token's granted permissions
            foreach (string perm in aToken.Permissions) {
                Debug.Log(perm);
            }
        } else{
            Debug.Log("User cancelled login");
        }
        HandleMenu(FB.IsLoggedIn);
    }

    void HandleMenu(bool isLoggedIn) {
        if (isLoggedIn) {
            DialogLoggedIn.SetActive(true);
            DialogLoggedOut.SetActive(false);
            logInStatusLabel.GetComponent<Text>().text = "Logged in as: ";

            if(FB_manager.Instance.ProfileName!=null){
                Text userName = Name.GetComponent<Text>();
                userName.text = "" + FB_manager.Instance.ProfileName;
            } else {
                StartCoroutine("WaitForProfileName");
            }

            if(FB_manager.Instance.ProfilePic!=null){
                Image image = ProfilePic.GetComponent<Image>();
                image.sprite = FB_manager.Instance.ProfilePic;
            } else {
                StartCoroutine("WaitForProfilePic");
            }

            if(FB_manager.Instance.ProfileEmail!=null){
                Text userName = Name.GetComponent<Text>();
                userName.text = "" + FB_manager.Instance.ProfileEmail;
            } else {
              StartCoroutine("WaitForProfileEmail");
            }

        } else {
            DialogLoggedIn.SetActive(false);
            DialogLoggedOut.SetActive(true);
            logInStatusLabel.GetComponent<Text>().text = "Not logged in";
        }
    }


    IEnumerator WaitForProfileName(){
        while(FB_manager.Instance.ProfileName==null){
            yield return null;
        }
        HandleMenu(FB.IsLoggedIn);
    }

    IEnumerator WaitForProfilePic(){
        while(FB_manager.Instance.ProfilePic==null){
            yield return null;
        }
        HandleMenu(FB.IsLoggedIn);
    }

    IEnumerator WaitForProfileEmail(){
        while(FB_manager.Instance.ProfileEmail==null){
            yield return null;
        }
        HandleMenu(FB.IsLoggedIn);
    } 
}

我可以连接到Unity中的数据库,以便它访问数据库以更新表。在单位内连接时仅提供更新权限。然后, id sc 可以被脚本包含(将php嵌入到脚本中)来更新表。用户是否可以更改脚本中的 id ?在部署游戏时,用户是否可以编辑脚本?

1 个答案:

答案 0 :(得分:1)

当用户使用Facebook凭据登录时,请在会话变量中设置其ID。在sql查询中使用session变量,以便只有用户才能更新他们的卡。