[RESOLVED] Hiding the link destination ??

[MichaelHe]

I'm having a little problem.

In short, I have some songs listed from a MySQL database.
Each song has a little speaker icon that links to mp3 files (they are called ex. 5.mp3 where 5 is the song id number)

"And don't worry, the mp3s is with permission and I'm paying for the uploads."

And here's problem:
It is as a small quiz with a form field, so you must quess which song is playing when the icon is clicked.
The problem is that you can easilly get help from others because you can see the song id number in the link, when the mouse is held over the icon.
Then you can just ask others what song 7 is ex. and they can just say that songid 7 is that song and so on.

The songs are shown in rand order everytime so the order isn't the same. But still you can see the song id in the link.

So how do I crypt this.

One idea:
Maybe I can crypt the id numbers and then link to another page playing the right song automaticly by de-crypting the number or something like that. And can this be done without being able to see which song is actually playing ??

Another Idea:
Maybe I can hide the link adresse when mouse over or something like that. But then you can still see which song it links to by showing the source.

What to do ??

[SpecialFX]

You could hash the songfile name, for instance:

You have the page be 'songs.php?id=7', and then have the song file name be

$song = sha1($_GET['id']).'.mp3';

Obviously you would have to rename the songs so they were hashed appropriate to their id. I would check out md5() and sha1() for hashing functions.

[etully]

Every time you are about to display a link to the song, generate a random 6 character string or a random 6 digit number. Then write the song's ID and the random string to a database. Then build the link with the random string or number.

When you actually make the link to the song, include the random string in the link instead of the id number. When the user mouses over the link, they will see the random string which means nothing to them since the same exact song would have a different random string for another user.

When the link is clicked and the random string is passed in, you are not receiving the song's id number, you are getting a code that can be used to look up the actual song ID in the database.

Note: Before you write the random string to the database, check to see if that random string was used before. If so, pick a different string so that you don't screw up someone else's session!

[MichaelHe]

To SpecialFX
I will look into that :o)

To etully:
I have thought of something like that, but when the 6 string code has been converted to the id number, how do I play the song.
I have tried different things but somehow the song has to be play and when it is won't the converted id number be in the source ??
I can figur out how to play the song wihtout the id number being visuable in the source.
I get the point with the crypted string, and this will help the link problem. But I can't seem to solve the play problem, without the correct id number being shown in the source of the page playing the song.

[etully]

MichaelHe wrote:

To etully:
I have thought of something like that, but when the 6 string code has been converted to the id number, how do I play the song.

When you link to the song, make the link point to this:
songload.php?code=384753

Then make a php file called songload.php like this:

<?
// read id from database based on six digit code passed in as $code

header("Content-Type: audio/mpeg");
readfile("song" . $id . ".mp3");

?>

[ShawnK]

here's one i made for images, you can just change it to audio

<?php 

// set the your image directory(from document root) 
$image_dir  = "./images/"; 

// make the image name safe 
$image_name = stripslashes( $_GET['img'] ); 

// get all images in the image dir 
$images = scandir( $image_dir ); 

// chop of "." and ".." from the images array 
$images = array_slice( $images, 2 ); 

// if the file doesn't exist die() 
if( array_search( $image_name, $images ) === FALSE ) die("<b>Error: </b> Image Not Found!"); 

// get the contents of the image 
$image_contents = file_get_contents( $image_dir . $image_name ); 

// site mime content-type to whatever the image type is 
header("Content-Type: ". mime_content_type( $image_dir . $image_name ) ); 

// get the image contents 
$image_contents = file_get_contents( $image_dir . $image_name ); 

// display the image 
echo $image_contents; 

?>

[davo666]

i thought, instead of writing to databases and having to check if you wreck someone elses (then you need a login/register script - alot of work) you store the hash of the file name in a $_SESSION[] var - it genius isnt it!

/ = doco root (what, im aussie)
ok so heres what you do you get the file thats supposed to be playing, get the filename, hash it and save the real song name in a session var, you then resave this hashed mp3 in /hashed/ and load that one and no many how many times they wave the cursor over it it will come up with the hash.mp3

then, in validation you match the answer with the session var

ps it has been proven that - what ever algorithm you use that

hash(md5, $filename)

is faster that md5() or sha1()

hope that helps....

[davo666]

• then delete the hashed file, hehe just a small detail

[etully]

I like your solution. You're on the right track. But this part causes too much unnecessary disk activity.

you then resave this hashed mp3 in /hashed/ and load that one
- then delete the hashed file

An improvement would be to create a symlink with the hashname pointing at the real file (and delete the symlink later)... or better yet, make a session variable that keeps track of the real filename and use readfile to deliver the contents of that file. (That way, there are no hash files to delete and no symlinks to clean up). Nice.

[bpat1434]

Why not just use simple javascript to hide it? onMouseOver and onMouseOut events can change the window.status message to whatever you want.

You could start a session, then take the session ID, and intersperse a hash of the ID with a hash of the session ID. Then link to it using that custom hash. then in songs.php you'd extract that information and construct the hash. Then hit a database to get the correct ID. Then stream that song. If I get a chance, I'll write up a demo.

[tekky]

I would use a table personally,

session_id,filename,code

create a code for each filename randomly for each session in use... no conflicts are possible, 2 people could have the same code for different files... and your PHP song server should obfuscate the location of hte song since it loads the file read file_get_contents or whatever... so you dont expose your original file names in anyway, no symlinks, no renaming/moving etc...

[MichaelHe]

Hi everyone... Thanks alot for your help.

To bpat1434:
I could hide the mouseover thing, but it will still be written if you see the source of the site.

I found out that I don't need a 6 string code.
And btw people are logged in so they have an ID.
He's how I have done it, and it works...

First I scramble the question ID's like this.

$crypt=mysql_query("select * from Crypt WHERE ProfilID='$id'");
$count = mysql_num_rows($crypt);

$crypt=mysql_query("select * from Question ORDER BY RAND()");
$all = mysql_num_rows($crypt);

IF($count<>$all){
while ($row = mysql_fetch_array($crypt)){
$questionid=$row['QuestionID'];
mysql_query ("INSERT INTO `Crypt` (`QuizID`, `ProfilID`) VALUES ('$questionid','$id')");
}
}

Now I have the same amount of question and the same question id's but in another order written in the Crypt table.
And as long as the order is stored in Crypt it will not make another order.

Then everytime I need an ID I Join the Crypt table with the Question table.

On another page I get the correct song id from the Crypt table and plays the song:

$crypt=mysql_query("select * from Crypt WHERE CryptID='$transforid' LIMIT 1");
while ($row = mysql_fetch_array($crypt)){$questionid=$row['QuizID'];}

header("Content-Type: audio/mpeg"); 
readfile($questionid.".mp3"); 

This way every link will have the crypted id number on it, but the right song wil play without anyone being able to see the correct ID.

At last... When people click Send to submit their answers I compare the answers by decrypting the id's by joining Crypt and Question.
Count how many are correct and put it in a user table.
And then delete the crypted numbers from the Crypt table and making new ones.

mysql_query("DELETE FROM `Crypt` WHERE ProfilID=$id");
$crypt=mysql_query("select * from Question ORDER BY RAND()");
while ($row = mysql_fetch_array($crypt)){
$questionid=$row['QuestionID'];
mysql_query ("INSERT INTO `Crypt` (`QuizID`, `ProfilID`) VALUES ('$questionid','$id')");}

So when a person log in a new scramled order of the question id's is made, and it stays like this until they take the quiz.
And everytime they try the quiz a new scrambled order is made.
Very clever I think 🙂

Thanks alot for all your input...
Now I just have another little problem which you can see here.
http://phpbuilder.com/board/showthread.php?t=10341673

[etully]

Can 15 people take the quiz at the same time?

[tekky]

From his write up, it seems so... and it seems like his code would support it fine...

Michael, thats essentially what I was explaining, just slightly different table workup.

[davo666]

to etully

i like my answer too 🙂

to everyone
winey voice: mark as resolved!!!

[MichaelHe]

Yes 15 people can take it at the same time.
The mp3's doesn't change name, and the scrambled order is stores along with their profilID, so each person has a different order, but ti's the same song id's it plays.

So thanks to all your threads I combined it to a great system :o)