Solved: WinHttpRequest to PHP security

[Movian]

Hey,
im sure your all sick of my posts by now but if someone isn't then i would apriciate a little help with WinHttpRequest.

I am producing an online licensing system where by an access database will periodicly connect to an online PHP script that will process the VBAs request and retrieve information from a MySQL database. Once this information has been retrieved it then Echo's in the information back via a basic custom encryption algorythm. and the VBA process the returned licensing information and takes apropriate action if required (disables database, activates a new license etc).

Now the problem i am having is that at the moment i am using the

MyCon.Open "GET", "http://www.somewebsite.com/example.php?Text1=info"
MyCon.Send
MyCon.WaitForResponse
Response = MyCon.ResponseText
format to push info to the online PHP script... now i am pretty sure this is a fairly unsecure method of doing this and i would prefer a more secure method if one exists.

Note that when storing passwords etc i am using an SHA standard hashing method aswell as my custom encryption method where a hash is not applicable (eg whenever a 2 way encryption is required rather than 1 way)

as all ways any help is apriciated.

[stanl]

hmmm.. maybe look at the setcredentials method, assuming security is set up on the PHP site. Stan

[Movian]

Ok well i can worry about that after i get this thing working to begin with

the following code retrievse a string of text from a PHP script and then splits it into a variable array. However the problem im having is that the table isn't updating with the retrieved values correctly.

(the connection URL has been removed for security reasons)


Public Sub CheckOnlineLicense(Display As Boolean, ProductKey As String)
Dim MyCon As New WinHttpRequest
Dim SendID As String, Response As String
Dim Var As Variant
Dim mydb As DAO.Database, myrs As DAO.Recordset, License As DAO.Recordset
Set mydb = CurrentDb()
Set myrs = mydb.OpenRecordset("Settings")
Set License = mydb.OpenRecordset("tblLicenseCodes")

If Not ProductKey = "" Then
SendID = ProductKey
Else
SendID = myrs.Fields("InstallID")
End If

'Connection string to send
MyCon.Send
MyCon.WaitForResponse
Response = MyCon.ResponseText
Var = Split(Response, ",")

If UBound(Var) = 7 And Var(7) = Crypto.SHA256(Var(0) & Var(1) & Var(2) & Var(3) & Var(4) & Var(5) & Var(6)) Then
License.MoveFirst
License.Edit
If Var(0) = "Y" Then
License.Fields("VeinSpecialist") = Crypto.Encrypt("VeinSpecialist")
Else
License.Fields("VeinSpecialist") = Crypto.Encrypt("Trial")
End If
If Var(1) = "Y" Then
License.Fields("Aesthetics") = Crypto.Encrypt("Aesthetics")
Else
License.Fields("Aesthetics") = Crypto.Encrypt("Trial")
End If
If Var(2) = "Y" Then
License.Fields("Vascular") = Crypto.Encrypt("Vascular")
Else
License.Fields("Vascular") = Crypto.Encrypt("Trial")
End If
If Var(3) = "Y" Then
License.Fields("Echo") = Crypto.Encrypt("Echo")
Else
License.Fields("Echo") = Crypto.Encrypt("Trial")
End If
If Var(4) = "Y" Then
License.Fields("Nuclear") = Crypto.Encrypt("Nuclear")
Else
License.Fields("Nuclear") = Crypto.Encrypt("Trial")
End If
If Var(5) = "Y" Then
License.Fields("Disabled") = Crypto.Encrypt("True")
License.Fields("Reason") = CStr(Var(6))
Else
License.Fields("Disabled") = Crypto.Decrypt("False")
End If
License.Update
myrs.Edit
myrs.Fields("LastLicenceCheck") = Format(Date, "mm/dd/yyyy")
myrs.Update
MsgBox "Succesfully retrieved license information from the Licensing Server", vbInformation, "Success"
Else
MsgBox "An Unforceen error has occured"
End If
License.Close
myrs.Close