Allow cross domain scripting (JS)

[UnseenXS]

Half PHP half JS question 😛 Is there anyway to use PHP to trick the browser into allowing cross domain scripting with JS? Like can PHP be used to change the domain header? or can PHP be used to write HTML/JS into another domain (or atleast in effect write HTML/JS into another domain?).. Help would be appreciated 🙂

[kakki]

i wont show you how to do this,
that would be the same question as "do you have an account i can use for hacking 'cose i am soooo lame, that i cannot hack my own "

[UnseenXS]

lol, possibly - except I'm not trying to hack anything or cause any harm, instead I am wanting to protect my own site which is under development from similar attacks. If it is possible to loophole the security features in MSIE or FF then I will have to secure my site in more ways than I have..

See, I am creating an online game - text based, anyways you perform certain actions by submiting forms. You can perform these actions say once every 2 mins.. JS can easily be used to mimic the form and submit it every 2 mins, I've secured that sort of script by checking the http_referer, I figure if the users browser doesn't send that header, though 😛

I have also secured my site against auto clicker/macroers that could be left on overnight by changing the order of the actions and a random button will appear that will not perform the action but log you out.

Now I am concerned about people using Javascript not just to mimic my form but to actually submit it. parent.mysitesframe.form.submit() 😛

I do not want to use number verification, but will only as a last resort - so any help would be greatly appreciated. Mind you if you don't trust me or think I'm up to no good then whatever, don't help - but don't make false accusations 😛

[oneboy]

You can use php to make a random image which contain a number or string,and save the number or string with cookie or you can just give a array about those.Then if who wants to submit form,it is requested to input the number or string on the image.You can check the number or string in the follow page.....

[kakki]

excuse me, UnseenXS, i didnt want to troll here ....

sorrysorrysorrysorrysorrysorrysorrysorrysorrysorry

i once read in an online-article that you should read the security-anouncements of
e.g. php-nuke to get the idea of what is possible ...

[ab4net]

hi, is it solved so far this issue, UnseenXS .. let us know ...

[russzee]

Essentially , if cross browser scripting is a security breach , how does Google implement their Adsense program by just having to paste this javascript on ur webpage..after which they track everything back from your domain to theirs.

<script type="text/javascript"><!--
google_ad_client = "pub-05567833523111";
google_ad_width = 728;
google_ad_height = 90;
google_ad_format = "728x90_as";
google_ad_type = "text_image";
google_ad_channel ="";
//--></script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>

Isn't it cross domain scripting , if nothing else....and how do u think they accomplished this on different browsers..