Difference between revisions of "HTTP Post request to a PHP server"

From Second Life Wiki
Jump to navigation Jump to search
m (language tags to <source>)
 
(20 intermediate revisions by 7 users not shown)
Line 1: Line 1:
== Introduction ==
{{LSL Header|ml=*}}


LSL now offer the ability to request HTTP page from any website.
== How to use ==
Second life allows scripts to make requests to a web site.


The command lets you send Post data to PHP.
The format of the HTTP Post is however a bit tricky.


You can use different methods to access your webserver.
This library lets you call a PHP page and post as many variables in your call as you want.
The most obvious is GET, the get method allows any number of parameters.


The syntax is :
On top of that I introduce a little checksum/password system to limit potential abuse.


http://www.yourwebsite.com/pay.php?user=Corto+Maltese&amount=100
== How to use ==


In the example above the page pay.php is requested with 2 parameters param1 and param2.
'''The second life script'''
The issue with GET is that if someone manage to sniff or guess your webpage, he could potentially take any webbrowser and type :


http://www.yourwebsite.com/pay.php?param1=Joe+Blog&amount=1000000
In the beginning of your script you must copy the xrequest function
and also choose a SECRET_NUMBER and a SECRET_STRING.
In SL you should also make sure that the script is not visible to other people than yourself (this is the default access right).


And your web server will have little idea that this request is bogus.
<source lang="lsl2">
integer SECRET_NUMBER=123456789;
string SECRET_STRING="abcdefghi";
key http_request_id;
xrequest(string url, list l)
{
    integer i;
    string body;
    integer len=llGetListLength(l) & 0xFFFE; // make it even
    for (i=0;i<len;i+=2)
    {
        string varname=llList2String(l,i);
        string varvalue=llList2String(l,i + 1);
        if (i>0) body+="&";
        body+=llEscapeURL(varname)+"="+llEscapeURL(varvalue);
    }
    string hash=llMD5String(body+llEscapeURL(SECRET_STRING),SECRET_NUMBER);
    http_request_id = llHTTPRequest(url+"?hash="+hash,[HTTP_METHOD,"POST",HTTP_MIMETYPE,"application/x-www-form-urlencoded"],body);
}
</source>


To make a call to the function you have to provide 2 parameters:


This is where my library comes into action.
For example:


The LSL library takes every character in your HTTP request and compute a security HashCode.
xrequest("http://www.yourserver.com/your_page.php",["parameter1",123,"parameter2","parameter2 value"]);
The library will then add this extra security hash parameter to your request like that:


http://www.yourwebsite.com/pay.php?user=Corto+Maltese&amount=100&hash=edabcc1792b33e7d6055cc4c8e69912c
The first parameter is the address of the webpage which will process your request. I assume, you own a website which supports PHP (about any version).


When the server receive the request, it will be able to check that the hash provided is correct.
The second parameter is a list containing the parameters you want to pass to the page.
If the request was tempered, the hash will not be correct, the server will therefore ignore the request and not allow Job Blog to pretend he has paid L$ 1,000,000.
They will be sent to the page as if they had been type in a WebForm.
The list can be empty [] or contain any number of 'variable name','variable value' pairs.


Also the library uses a POST method, the POST method is not very different from GET but allow slightly more input parameters than GET, The POST method is also a bit more secure as the parameters do not appears in the cache statistics or similar tools.
'''The PHP Page'''


== Syntax ==
The php page must contains the function below, if you're a PHP wiz, you also include it inside another file.


The main LSL function is called xrequest
Note that the page must be modified to contain your own SECRET_NUMBER.
Your page will then use the function checkHash() to make sure the correct password was used.
If the password is wrong, the page won't run any further.


  xrequest(string Url, List Parameters)
If the password is right you can then read the content of the parameters using a simple $_POST["parameter_name"]


Url :
<source lang="php">
  is the address of your webpage. for example "http://www.yoursite.com/sl.php"
<?php
 
  // this function tweak slightly urlencode to make it behave exactly like llEscapeURL in Second Life.
Parameters :
   function llEscapeURL($s)
  is a list of string, the list must be set in pairs using this format:
  [variable_name_1, variable_value_1, variable_name_2, variable_value_2, ...]
 
 
In the example below the script request a page using the parameters a=1, b=2 and c=3.
<code>
   default
   {
   {
      touch_start(integer total_number)
    $s=str_replace(
       {
       array(" ","+","-",".","_"),
          xrequest("http://www.yoursite.com/sl.php",["a","1","b","2","c","3"]);
      array("%20","%20","%2D","%2E","%5F"),
      }
       urlencode($s));
     
    return $s;
      http_response(key request_id, integer status, list metadata, string body)
   }   
       {
          if (request_id == http_request_id)
          {
              llSetText(body, <0,0,1>, 1);
          }
      }
     
   }
</code>
 
Here is the code of the xrequest function.
Note that you should change the SECRET_NUMBER to any number of your choice but preferably something rather large and random up to 2,000,000,000.
 
<code>
   integer SECRET_NUMBER=123456789;
    
    
   xrequest(string url, list l)
   // this my main SL page XML-RPC page
  function checkHash()
   {
   {
      integer i;
    global $body;
      integer len=llGetListLength(l) & 0xFFFE; // makes the list count even
    $hash=$_GET["hash"];
      string body;
    $body="";
 
    $cpt=0;
    for (i=0;i<len;i+=2)
    $SECRET_NUMBER=123456789;
    {
    $SECRET_STRING="abcdefghi";
          string varname=llList2String(l,i);
 
          string varvalue=llList2String(l,i + 1);
    foreach ($_POST as $name => $value) {
          if (i>0) body+="&";
      if ($cpt++>0) $body.="&";
          body+=llEscapeURL(varname)+"="+llEscapeURL(varvalue);
      if (get_magic_quotes_gpc()) {
        // $name = stripslashes($name); not a good idea though
        $value = stripslashes($value);
        $_POST[$name]=$value;
       }
       }
       string hash=llMD5String(body,SECRET_NUMBER);
       $body.=llEscapeURL($name)."=".llEscapeURL($value);
       http_request_id = llHTTPRequest(url+"?hash="+hash,[HTTP_METHOD,"POST",HTTP_MIMETYPE,"application/x-www-form-urlencoded"],body);
    }
    $calcHash=md5($body.$SECRET_STRING.':'.$SECRET_NUMBER);
    if ($hash!=$calcHash)
    {
       sleep(2); // slow down the requests
      echo "result=FAIL\nMSG=Invalid request.";  
      die;
    }
   }
   }
</code>


On the server side here is the PHP function which will allow your server to check the securty hash:
  checkHash();
  // You can use the parameters here by simply using $_POST["parameter_name"]
  echo "OK";
?>
</source>


<code>
I hope it helps.
<?php
Don't hesitate to ask any question to Corto Maltese or improve this page.
  // this function tweak slightly urlencode to make it behave exactly like llEscapeURL in Second Life.
  function llEscapeURL($s)
  {
  $s=str_replace(
  array(" ","-",".","_"),
  array("%20","%2D","%2E","%5F"),
  urlencode($s));
  } 
 
  // this my main SL page XML-RPC page
  function checkHash()
  {
  global $body;
  $hash=$_GET["hash"];
  $body="";
  $cpt=0;
  $SECRET_NUMBER=123456789;
  foreach ($_POST as $name => $value) {
  if ($cpt++>0) $body.="&";
  $body.=llEscapeURL($name)."=".llEscapeURL($value);
  }
  $calcHash=md5($body.':'.$SECRET_NUMBER);
  if ($hash!=$calcHash)
  {
  sleep(2); // slow down the requests
  echo "result=FAIL\nMSG=Invalid hash"; + $body="";
  die;
  }
  }
 
 
  checkHash();
  // You can use the parameters here by simply using $_POST["parameter_name"]
  echo "OK";
  ?>
</code>


This library could be improved, to treat output parameter too.
It doesn't do anything in this area yet.


[[Category:LSL Library|Secure HTTP Post]]
{{LSLC|Library}}

Latest revision as of 19:27, 24 January 2015

How to use

Second life allows scripts to make requests to a web site.

The command lets you send Post data to PHP. The format of the HTTP Post is however a bit tricky.

This library lets you call a PHP page and post as many variables in your call as you want.

On top of that I introduce a little checksum/password system to limit potential abuse.

How to use

The second life script

In the beginning of your script you must copy the xrequest function and also choose a SECRET_NUMBER and a SECRET_STRING. In SL you should also make sure that the script is not visible to other people than yourself (this is the default access right). 

 integer SECRET_NUMBER=123456789;
 string SECRET_STRING="abcdefghi";
 key http_request_id;
 
xrequest(string url, list l)
{
    integer i;
    string body;
    integer len=llGetListLength(l) & 0xFFFE; // make it even
    for (i=0;i<len;i+=2)
    {
        string varname=llList2String(l,i);
        string varvalue=llList2String(l,i + 1);
        if (i>0) body+="&";
        body+=llEscapeURL(varname)+"="+llEscapeURL(varvalue);
    }
    string hash=llMD5String(body+llEscapeURL(SECRET_STRING),SECRET_NUMBER);
    http_request_id = llHTTPRequest(url+"?hash="+hash,[HTTP_METHOD,"POST",HTTP_MIMETYPE,"application/x-www-form-urlencoded"],body);
}

To make a call to the function you have to provide 2 parameters:

For example:

xrequest("http://www.yourserver.com/your_page.php",["parameter1",123,"parameter2","parameter2 value"]);

The first parameter is the address of the webpage which will process your request. I assume, you own a website which supports PHP (about any version).

The second parameter is a list containing the parameters you want to pass to the page. They will be sent to the page as if they had been type in a WebForm. The list can be empty [] or contain any number of 'variable name','variable value' pairs.

The PHP Page

The php page must contains the function below, if you're a PHP wiz, you also include it inside another file.

Note that the page must be modified to contain your own SECRET_NUMBER. Your page will then use the function checkHash() to make sure the correct password was used. If the password is wrong, the page won't run any further.

If the password is right you can then read the content of the parameters using a simple $_POST["parameter_name"] 

<?php
  // this function tweak slightly urlencode to make it behave exactly like llEscapeURL in Second Life.
  function llEscapeURL($s)
  {
    $s=str_replace(
      array(" ","+","-",".","_"),
      array("%20","%20","%2D","%2E","%5F"),
      urlencode($s));
    return $s;
  }   
  
  // this my main SL page XML-RPC page
  function checkHash()
  {
    global $body;
    $hash=$_GET["hash"];
    $body="";
    $cpt=0;
    $SECRET_NUMBER=123456789;
    $SECRET_STRING="abcdefghi";

    foreach ($_POST as $name => $value) {
      if ($cpt++>0) $body.="&";
      if (get_magic_quotes_gpc()) {
        // $name = stripslashes($name); not a good idea though 
        $value = stripslashes($value);
        $_POST[$name]=$value;
      }
      $body.=llEscapeURL($name)."=".llEscapeURL($value);
    }
    $calcHash=md5($body.$SECRET_STRING.':'.$SECRET_NUMBER);
    if ($hash!=$calcHash) 
    {
      sleep(2); // slow down the requests
      echo "result=FAIL\nMSG=Invalid request."; 
      die;
    }
  }

  checkHash();
  // You can use the parameters here by simply using $_POST["parameter_name"] 
  echo "OK";
?>

I hope it helps. Don't hesitate to ask any question to Corto Maltese or improve this page.

Retrieved from "https://wiki.secondlife.com/w/index.php?title=HTTP_Post_request_to_a_PHP_server&oldid=1195015"