我将使用 SWFObject 在我的页面中嵌入 Flash 对象并传递变量。用户可以欺骗这些变量吗？
我想知道我能在多大程度上确定我的网站的用户将无法将虚假变量传递到我的 Flash 影片。基本上我将为某些用户提供一些功能，并且我意识到对于普通用户来说，他们不知道如何发送欺骗变量，但是有人可以在页面加载时更改使用 SWFObject 发送的变量，从而能够使用我试图为他们禁用的功能。
我有一个 PHP (my_flash_movie.php) 页面，它从包含的 globals.php 文件中调用函数来确定用户是否可以看到受限功能 - is_user_a_subscriber($_SESSION['user_id']);返回 1 或 0。然后，该 1 或 0 被传递到 Flash，从而启用或禁用某些功能。我基本上不希望有人能够发送 1 而不是 0。这不是一个安全至关重要的网站，被禁用的功能也不是真正重要，所以如果发生这种情况也不会太糟糕，但我只是对此感到好奇，想知道我是否应该考虑另一种方式来传递这些可能更重要的变量隐。
如果有人能够做到这一点（传递欺骗变量），他们会怎么做？
干杯
i am wanting to know how much I can be sure that users of my website will not be able to pass bogus variables to my Flash movie. Basically I will have some features available to certain users and I realise that for the average user they will not know anything about how to send spoof vars but is it possible for someone to change the variables sent using SWFObject when a page loads and thus be able to use the functionality that I am trying to disable for them.
I have a PHP (my_flash_movie.php) page that calls a function from an included globals.php file to determine if the user can see the restricted functionality - is_user_a_subscriber($_SESSION['user_id']); which returns 1 or 0. This 1 or 0 is then passed to Flash which enables or disables certain features. I dont want someone to be able to send a 1 instead of a 0 basically. This isnt a site where security is critical and the functionality that is disabled is not really critical either so wouldnt be too bad if this happened but im just curious about this and wondering if I should think of another way to pass these vars that might be more hidden.
If someone is able to do this (pass spoof variables) how would they do it?
cheers
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如何将 0/1 值传递给 Flash 影片？如果您在 URL 或 HTML 中包含的任何参数中执行此操作，那么用户将始终能够欺骗它。即使您隐藏了需要传递参数的事实（例如，不传递任何已禁用的功能，而是传递一个特殊值来启用它），任何有动机的用户仍然能够反编译您的 Flash 并发现它。您可以做的最合理的事情就是不要将此功能发送给您本来就不希望拥有它的用户。您基本上必须提供两个 Flash 文件。如果用户得到的文件的功能被完全删除，他将无法轻松打开它。尽管任何获得完整功能的人都可以将文件或 URL 提供给其他人，但如果可以的话，那么它可能足以满足您的需求。
How do you pass the 0/1 value to the Flash movie? If you do it in URL or any parameters that are included in HTML then the user will always be able to spoof it. Even if you hide the fact that there even is a parameter to pass (eg. not pass anything for disabled features and pass a special value to enable it) any motivated user will still be able to decompile your Flash and discover it. The most reasonable thing you could do is not send this functionality to users that you don't want to have it in the first place. You would basically have to provide two Flash files. If the user gets a file with the functionality removed altogether he won't be able to easily turn it on. Though still anyone who gets the full functionality will be able to give the file or url to other people but if that's ok then it might be enough for your needs.
据我所知，您不能附加来自其他域（或子域）的外部变量，除非您在两个站点上使用 crossdomain.xml 。
了解更多信息，请访问http://kb2.adobe.com/cps/142/tn_14213.html< /a>
As far as I know, you can't attach external variables from other domains (or subdomains), unless You use crossdomain.xml on both sites.
Learn more at http://kb2.adobe.com/cps/142/tn_14213.html
如果您消除中间人并让 Flash 直接与 PHP 对话，也许您会拥有一个更安全的站点。
Maybe you would have a more secure site if you cut out the middleman and had Flash speak directly to PHP.