Joe H wrote:
> Eddie Shipman wrote:
>
> > Joe H wrote:
> > > I found surely the simplest way of doing it. Web accesses are
> > > automatically entered in our website logs along with any
> > > parameters that were sent with them. Using that, all I need to do
> > > is, if a user is on the unauthorised list, I pull up a web page
> > > with an error warning that tells the user to call tech support,
> > > and that access includes an encrypted form of the program's
> > > serial number as a parameter. At the end of the month I scan the
> > > logs looking for accesses to that page and decode and lookup the
> > > parameter codes to identify which user attempted the access. This
> > > requires no database, no backend support on the web site, no
> > > script (not-even javascript in the web page) and really should do
> > > all that I need to do with this.
> > >
> > > If you see any problems with this approach, please point them out.
> > > Thanks again for answering.
> >
> > How will your web app know if they are authorized?
>
> There is no app on the web. Just a file which we update from our
> office. The program itself uses winInet functions to download a small
> binary file of hashed serial numbers of those who are NOT authorised.
> We don't have many. The program downloads that file and checks if it's
> serial number hash is in the file. If not we presume they are
> authorised. It's only serial numbers of customers who did charge-backs
> or returned the software for credit and then attempt to continue to
> use the programs or credit card thieves where the only thing we know
> about them is the program's serial number. Again we don't have more
> than maybe a couple of dozen entries. If we were to get thousands of
> entries, then it might become necessary to make a simple database and
> script on the web site to look up the hash and return a true/false
> result but hopefully that will not become necessary.
I see, then it is very easy to do in your app. If you make your file
XML, then you can easily use XMLHTTPRequest .vs WinInet to do this kind
of thing. It is easier to work with. Here's an example of getting an
XML file from a website using it:
uses ..., MSXML2_TLB, COmObj;
function ValidSerial(ASerialNum: String): String;
var
oXMLDoc: IXMLDOMDocument2;
oXMLHTTP: IXMLHTTPRequest;
oSerialNode: IXMLDOMNode;
begin
oXMLDoc := CreateOleObject('MSXML2.DOMDocument.3.0') as
IXMLDOMDocument2;
oXMLHTTP := CreateOleObject('MSXML2.XMLHTTP') as IXMLHTTPRequest;
try
oXMLHTTP.open('GET', 'URL', False, '', '');
oXMLHTTP.send(EmptyParam);
// The ResponseText contains the XML returned from the GET
oXMLDoc.LoadXML(oXMLHTTP.ResponseText);
// Parse the XML for the current serial number to see if it exists.
//
// The serial code would be in a node defined like this in this
example:
// <Serial-0123-4567-8901-2345>Bad
Check</Serial-0123-4567-8901-2345>
//
oSerialNode := oXMLDoc.selectSingleNode('//Serial-'+ASerialNum);
if oSerialNode <> nil then
Result := oSerialNode.Text
else
Result := '';
finally
oXMLDoc := nil;
oXMLHTTP := nil;
end;
end;
procedure TForm1.Button1Click(Sender: TObject);
begin
Label1.Caption := ValidSerial(Edit1.Text);
end;
Example XML file:
<?xml version="1.0" encoding="iso-8859-1"?>
<BadSerials>
<!--
Nodename MUST begin with an Alpha char
Reason is in the Node.Text
-->
<Serial-0123-4567-8901-2345>Bad Check</Serial-0123-4567-8901-2345>
<Serial-4567-8901-2345-0123>Charge Back</Serial-4567-8901-2345-0123>
</BadSerials>
--
