[Solved] Http.CreatePost (Text Url, Text Resource)

[steeffeen]

hey there

i tried to create a post request in my script but i have some issues

like spaii mentioned here http://forum.maniaplanet.com/viewtopic. ... 48#p144248

by the way, with CreatePost, in php, I have to get the posted variables with $_GET and not $_POST

requests like that end up with parameters sent via GET

Code: Select all

Http.CreatePost("url.php?param=value", "");

so i tried sending the data via the 2. parameter but then there is no parameter sent at all

Code: Select all

Http.CreatePost("url.php", "param=value");

does anyone know how to properly create a post request?
and what's the point of the second parameter "Resource"

thanks in advance
steff

[m4rcel]

To get the second parameter in your script, you have to use the following line:

Code: Select all

$resource = file_get_contents('php://input');

This is the same as if you would use the already known POST() function as links in Quads or Labels

So in your second example, $resource would be "param=value". If you want to send multiple parameters, you have to parse the query string for yourself.

[spaii]

Hi steeffeen, m4rcel

I know, ir's not the good post for this question

Did you know if we can sniff POST values ?

I use httpnetworksniffer on windows, and i can see GET values.

I'm trying to hack my proper world records system, since it's really easy to telnet stunters server with GET methods and change the records we want.

i didn't find good documentation on POST methods and security...

[m4rcel]

You can sniff POST parameters, because you can sniff the whole request which is sent to the servers. Each tool, which is able to view the whole request e.g. in its raw format, will reveal the POST data at the end of it.

An example:

Code: Select all

POST /test.php?param=value HTTP/1.1
Accept: */*
Content-Type: application/binary
User-Agent: ManiaPlanet/3.3.0 (Windows; rv: 2013-07-04_11_32; context: none; distro: ABEBA)
Host: localhost
Content-Length: 11
Connection: Keep-Alive
Cache-Control: no-cache

Hello World

"param=value" in the first line is the GET parameter, "Hello World" in the last line is the content which has been POSTed to the script.

So it's not really harder to manipulate than GET, if you know, how it must look like

[spaii]

Thx for response