Can I connect to IFastNet database with a Python script located on browser?

Hi. I’m pretty sure you can. I just wanna make sure of something: are you gonna distribute your games with phpmyadmin code in it ? Because if you do that, you will need to pass the credentials and a little reverse engineering software (since Python apps distibuted with PyInstaller are super easy to reverse engineer if you know how to) and people can login and do anything they want with the database.
Prefer to make a PHP script that you send POST data to using the requests Python module or the urllib.request (lower level, a bit more hard) module, and make the PHP script login to the DB and do all the stuff.
Make sure to properly encode and decode stuff to not make your app vulnerable to MySQL injections (“SELECT name FROM people WHERE family_name = [userdata] AND registered = 1” with “a; TRUNCATE TABLE people; --” as user data gaves “SELECT name FROM people WHERE family_name = a; TRUNCATE TABLE people; – AND registered = 1” so bad guys can delete the data but also see it using other ways, basically they can do anything from here) or XSS attacks (bad guy posting a text that load a script when loading the text on other people computer if the text is not handled properly) and if you use compression somewhere to make requests tinier, decompression bombs as they can overflow the server ressources and take it down.
If you dont have a Premium plan from iFastNet, Python scripts wont be able to load your website pages (see my forum posts) unless you decide to emulate the JavaScript code and the cookies to get the page but I clearly dont recommend this as its not stable and very time and power consuming).
If you want to have a nocost solution, take a look at Replit.com, just note that every code is public unless you pay for a premium plan and mark your repository as private (public means its forkable and readable but not writable by anyone), also on Replit you’ll be able to code in basically any language including Python. If you use Replit, dont use their database system: its super limited. Instead, take a look at the sqlite3 module of Python or something similar in annother language, to store MySQL databases in a single file. Want a tip for keeping your database file private ? Encrypt it with AES256 with a key that you will store in environement variables called Replit Secrets: only you can use and see secrets. Thought, it’s a workaround, it’s not very optimized. Also, to keep your app running and working (except if its an HTML/CSS/JS repository, they are static and dont need to be ran to be online) you have to pay for a premium plan too. Or you watch a YouTube tutorial how to use UptimeRobot.com to make your repository alive without paying (that’s a workaround, not a solution !).

Good programming !

[Ok, I know it’s a webhosting forum, not a programming forum but anyways I just wanna help this guy]
Edit: Just saw that @anon42008019 said somethinf similar, this answer is completing his one
Edit 2: If you are using Python to build the server, take a look at the socket module and watch a tutorial: this module should not be very hard compared to websockets. For ports, you should use a non-reserved port, using a port higher than like 20000 is recommended, for more info about ports search non-reserved ports and read the Wikipedia article. Also, I didn’t knew iFastNet’s Premium plan could run Python scripts. Good to know.

2 Likes

Hi @HGStyle , sorry for the late reply.
Thanks for your detailed help.
Firstly, Python won’t be running on IFastNet of InfinityFree, it will be running on the browser of the player but linked to the database…
I tried Socket but i also want to link it to the player’s account that is on the website (eg: name, friends, score, …) and IFastNet allows external connexions with SQL Remote. Maybe I can use socket for ingame positions and stuff but linking the computers is kind of chaotic
I found some encrypting methods, like python scripts are in a .txt file and encrypted. There is a a Batch file executing and decoding it and more.
And yeah, I always use prepared statements with PHP.
Thanks again!

No no no no…
You should look up reverse engineering communities, the “never trust the client” is a slogan for a reason.

7 Likes

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.