我遇到了一个问题,有人不断利用机器人攻击我的投注网站。他能够(大概)使用机器人非常快速地多次按下“滚动”按钮并获得相同的滚动数字。
滚动按钮使用一个函数来工作。这是这个函数:
var rolling=false;
var lastBet=(Date.now()-<?php echo $settings['rolls_mintime']; ?>-1000);
function place(wager,multiplier,bot) {
if ((rolling==false && (Date.now())>=(lastBet+<?php echo $settings['rolls_mintime']; ?>)) || bot==true) {
rolling=true;
lastBet=Date.now();
$("#betBtn").html('ROLLING');
if (bot!=true) _stats_content('my_bets');
$.ajax({
'url': './content/ajax/place.php?w='+wager+'&m='+multiplier+'&hl='+under_over+'&_unique=<?php echo $unique; ?>',
'dataType': "json",
'success': function(data) {
if (data['error']=='yes') {
if (data['data']=='too_small') alert('Error: Your bet is too small.');
if (data['data']=='invalid_bet') alert('Error: Your balance is too small for this bet.');
if (data['data']=='invalid_m') alert('Error: Invalid multiplier.');
if (data['data']=='invalid_hl') alert('Error: Invalid under/over specifier.');
if (data['data']=='invalid_bts') alert('Using bots, tut tut.');
if (data['data']=='too_big_bet') alert('Error: Your bet is too big. Currently max profit is set at: '+data['under']+' this represents 1% of the invested backroll.');
}
else {
var result=data['result'];
var win_lose=data['win_lose'];
if (win_lose==1) winCeremonial();
else shameCeremonial();
}
然后这个函数会指向 php 文件。这是它的标题:
if (empty($_GET['_unique']) || mysql_num_rows(mysql_query("SELECT `id` FROM `players` WHERE `hash`='".prot($_GET['_unique'])."' LIMIT 1"))==0) exit();
$playerinv=mysql_fetch_array(mysql_query("SELECT `id`,`playcoins`,`time`, `ex`, `server_seed` FROM `players` WHERE `hash`='".prot($_GET['_unique'])."' LIMIT 1"));
$random = base64_encode(openssl_random_pseudo_bytes(10));
$setstring = $random;
mysql_query("UPDATE `players` SET `string` = '$setstring' WHERE `id`=$playerinv[id] LIMIT 1");
$playersec=mysql_fetch_array(mysql_query("SELECT `string` FROM `players` WHERE `hash`='".prot($_GET['_unique'])."' LIMIT 1"));
if ($setstring != $playersec['string']) {
echo json_encode(array('error'=>'yes','data'=>'invalid_bts'));
exit();
}
$newSeed=generateServerSeed();
mysql_query("UPDATE `players` SET `server_seed`='$newSeed' WHERE `id`=$playerinv[id] LIMIT 1");
$settings=mysql_fetch_array(mysql_query("SELECT * FROM `system` LIMIT 1"));
$player=mysql_fetch_array(mysql_query("SELECT * FROM `players` WHERE `hash`='".prot($_GET['_unique'])."' LIMIT 1"));
$player['server_seed_']=$player['server_seed'];
$player['server_seed']=(double)substr($player['server_seed'],27);
正如您从一开始就看到的,我尝试通过生成一个专用于该运行的随机字符串 ($setstring)、存储它然后将其与自身进行比较来创建解决方法。然而不知何故,他设法跑得足够快,也克服了这一点。
$newseed 是具有卷号的变量。正如您所看到的,每次运行时通常都会生成一个新的。我通常对他如何做到这一点感到困惑,因为我认为每个 php 文件都是单独运行的。
谁能帮忙提供一些见解或解决方案!例如,有人建议我进行事务封装,但不确定如何实现。感谢您抽出宝贵的时间。