Backyard Boxin - Scratch n Match

Name: Scratch n Match

Version: Unknown (circa 2004)

Total Files: 14

Total Size: 0.04 MB

Created Date: Unknown (circa 2004)

Last Updated: Unknown

Author: Peter Kuntz (This email address is being protected from spambots. You need JavaScript enabled to view it.)

Company: KPP Internet Promotions

Copyright: KPP Internet Promotions

License: Custom Proprietary (not GPL, requires license)

Project URL: http://www.kppdesign.nl (defunct)

PHP Version: PHP 4.x

Database: MySQL with MyISAM engine

Server: Apache with IE-specific JavaScript

File Composition

File Type	Count	Total Size (MB)	Purpose
.jpg	6	0.014	Scratch card symbols (crown, seven, diamond, ruby, magic, x)
.phtml	5	0.007	PHP template files (game, admin, config, languages)
.txt	2	0.019	Documentation (readme, license)
.sql	1	<0.001	Database schema
Total	14	0.04	Minimal standalone package

File Distribution Analysis:

• Graphics (43%): 6 scratch card symbol images
• Code (36%): 5 PHP template files for all functionality
• Documentation (14%): Installation and license info
• Database (7%): Single SQL schema file

Platform: Standalone web mini-game (embeddable)

Frontend: DHTML with IE-specific JavaScript

Backend: Pure PHP procedural code

Communication: Page reload per play

Session Management: IP-based tracking (no user accounts)

Real-time Updates: Mouse-over div removal (DHTML magic)

Game Engine: Modulo-based RNG for win determination

Key Technical Features:

• Pure DHTML scratch interface (no images, pure CSS layers)
• IE-specific JavaScript (document.all, JScript events)
• IP-based play limiting (no authentication required)
• Algorithmic win determination (modulo math)
• Multi-language support (Dutch, English)
• Admin panel for parameter tuning
• Zero dependencies (embeddable in any site)

Scratch n Match is a virtual scratch card mini-game where players "scratch" three cards by hovering their mouse over gray overlay panels. The game reveals three symbols, and matching all three wins the jackpot. It's designed as an embeddable gambling widget for other websites, particularly online games needing a lottery/gambling feature.

This is a commercial product by KPP Internet Promotions - a Dutch web design company selling PHP widgets and mini-games. The product was designed to be integrated into existing websites with minimal configuration (just database credentials).

The "BackyardBoxin - ScratchnMatch" naming suggests this was either sold to or bundled with Backyard Boxin game (which we analyzed previously).

Genre: Casino Mini-Game / Virtual Scratch Card / Gambling Widget

Theme: Lottery scratch tickets

Game Style: Simple mouse-driven gambling

Target Audience: Website owners needing gambling features

Gameplay Pace: Instant (1-2 seconds per play)

Integration: Embeddable widget, not standalone game

Scratch Card Interface

Core Mechanic:

• Three scratch cards displayed side-by-side (125px x 100px each)
• Each card covered by 64 gray overlay DIVs (4x4 grid of 25px squares, 4 shades)
• Mouse hover removes DIV, revealing symbol underneath
• When all DIVs removed, win/loss determined

Visual System:

• 4 Gray Shades (CSS layers):
• .general3 - #333333 (darkest, z-index:4)
• .general2 - #555555 (dark, z-index:3)
• .general1 - #777777 (light, z-index:2)
• .general0 - #999999 (lightest, z-index:1)
• Creates visual depth effect
• 192 total DIVs (3 cards × 64 DIVs each)

Symbol Library (6 symbols):

• Crown (gfx/crown.jpg) - Royalty symbol
• Seven (gfx/seven.jpg) - Lucky number
• Diamond (gfx/diamond.jpg) - Gem symbol
• Ruby (gfx/ruby.jpg) - Precious stone
• Magic (gfx/magic.jpg) - Mystical symbol
• X (gfx/x.jpg) - Loss marker

Win/Loss Algorithm

Algorithmic Fairness System:

if ($total % $chance == 0) {
  $winner = 1; // Win
}

How It Works:

• Every play increments kr_total counter
• When total plays modulo chance equals zero, player wins
• Default: 1 in 10 chance (kr_chance = 10)
• Example: Plays 1-9 lose, play 10 wins, plays 11-19 lose, play 20 wins

Win Condition:

if (winner) {
  // All 3 symbols match
  document.scratch1.src = sc[random];
  document.scratch2.src = document.scratch1.src; // Copy
  document.scratch3.src = document.scratch1.src; // Copy
} else {
  // Symbols don't match
  document.scratch1.src = sc[random];
  document.scratch2.src = sc[random];
  document.scratch3.src = sc[random];
  // Ensure #2 and #3 differ
  while (document.scratch2.src == document.scratch3.src) {
    document.scratch3.src = sc[random];
  }
}

Play Limiting System

Three-Tier Restrictions:

• Per-IP Daily Limit:
• Default: 100 plays per IP per day (kr_timesaday)
• Tracked in kras_users table
• Uses IP address + current date
• Prevents single player abuse

• Daily Win Cap:
• Default: 100 total wins per day (kr_max_wins)
• Once reached, ALL players locked out
• Prevents site bankruptcy
• Counter: kr_wins (resets manually)

• Total Play Counter:
• kr_total tracks lifetime plays
• Used for modulo win calculation
• Never resets (ensures randomness)

Restriction Messages:

• Exceed daily plays: "You can only play [X] times per day"
• Max wins reached: "Maximum wins reached today"

Administrative Controls

Admin Panel (scratchadmin.phtml):

Configurable parameters:

• Win Chance (kr_chance)
• Format: 1 : X ratio
• Default: 10 (1 in 10 odds)
• Integer only
• Example: 20 = 5% win rate

• Max Wins Per Day (kr_max_wins)
• Default: 100 wins
• Prevents massive payouts
• Site owner protection

• Plays Per IP Per Day (kr_timesaday)
• Default: 100 plays
• Anti-abuse measure
• Prevents bot grinding

Statistics Visible:

• Total plays (kr_total)
• Current wins today (kr_wins)
• Current chance ratio
• Max wins setting
• Times per day limit

Multi-Language Support

Two Languages Included:

• English (english.phtml)
• UI text labels
• Win/loss messages
• Error messages

• Dutch (dutch.phtml)
• Native language for KPP
• Complete translation

Configurable in config.phtml:

`php

$languagefile = "english.phtml"; // or "dutch.phtml"

`

Custom Language Support:

• Copy english.phtml
• Rename to yourlanguage.phtml
• Translate text labels
• Update config.phtml

Integration Model

Embed Requirements:

• Copy files to web directory
• Edit config.phtml:
• Database hostname
• MySQL username
• MySQL password
• Database name
• Language file
• Run createtables.sql
• Link from host site

Standalone or Embedded:

• Can run standalone (scratch.phtml)
• Can be iframe embedded
• Can be integrated with custom wrapper
• No authentication required (IP-based)

2 Tables (MyISAM):

• kras_params - Game configuration (1 row always)
• kr_total (int) - Total plays lifetime
• kr_chance (int) - Win frequency (1:X ratio)
• kr_max_wins (int) - Daily win cap
• kr_wins (int) - Current wins today
• kr_timesaday (int) - Per-IP daily limit

• kras_users - Play tracking
• usr_ip (varchar 15) - Player IP address
• usr_date (date) - Play date
• One row per play per IP per day

Default Configuration:

INSERT INTO kras_params VALUES (0, 10, 100, 0, 100);
-- total:0, chance:1/10, max_wins:100, wins:0, times/day:100

Database Design Notes:

• No foreign keys (simple tables)
• No indexes defined (small data set)
• MyISAM for simplicity (no transactions needed)
• Date-based tracking (auto cleanup possible)

Implemented Features:

DHTML scratch interface

Mouse-over reveal mechanic

6 symbol graphics

Algorithmic win determination

IP-based play limiting

Daily win cap system

Admin configuration panel

Multi-language support (2 languages)

Play again button

Win/loss alerts

Total play tracking

Date-based restriction reset

Feature Completeness: 100%

This is a complete, production-ready widget ready for embedding.

Missing/Incomplete Features:

No user accounts (by design - IP-based)

No prize configuration (handled by parent site)

No sound effects

No animation (instant reveal)

No mobile touch support (mouse-only)

No modern browser support (IE-specific)

Strong Design Elements:

• Pure DHTML Interface - No Flash, no Java applets
• 192 positioned DIVs create scratch effect
• CSS z-index layering for visual depth
• Mouse-hover removal is clever UX
• Lightweight (40KB total)

• Algorithmic Fairness - Modulo-based wins
• Transparent randomness
• Configurable odds
• Predictable house edge
• No server-side RNG manipulation risk

• IP-Based Limiting - No authentication needed
• Date-based tracking
• Per-IP daily limits
• Simple anti-abuse
• Zero user friction

• Embeddable Design - True widget approach
• Self-contained (14 files)
• Minimal configuration
• No dependencies
• Database isolation (2 tables)

• Multi-Language - International appeal
• Easy translation system
• Dutch/English included
• Template-based text

• Admin Control - Site owner protection
• Win rate adjustment
• Daily win caps
• Play limiting
• Live statistics

Well-Architected Features:

• Clean separation (game/admin/config)
• Template-based language system
• Single configuration file
• Minimal database footprint
• Modular integration

Strengths:

• Clean file organization
• Clear comments with author/purpose
• Modular design (separable components)
• Simple configuration
• Language abstraction
• Self-documenting variable names

Weaknesses:

• IE-specific JavaScript (document.all)
• JScript event handlers (non-standard)
• No prepared statements (SQL injection)
• Direct variable usage ($chance, $host)
• No input sanitization
• Ancient mysql_* functions
• No error handling
• Inline JavaScript generation (security risk)
• Global variables throughout
• register_globals dependency ($action, $chance)
• No CSRF protection on admin
• No authentication on admin panel

Code Audit Example:

// From scratch.phtml - SQL injection:
$q_checktimes = "select count(*) from kras_users
                 where usr_ip='$host' and usr_date=CURDATE();";
// $host = $REMOTE_ADDR (can be spoofed)
// No escaping, direct concatenation

// From scratchadmin.phtml - Multiple vulnerabilities:
if ($action == "save") {
  $savequery = "update kras_params
                set kr_chance='$chance',
                kr_max_wins='$maxwins',
                kr_timesaday='$timesaday';";
}

// Issues:
// 1. No authentication (anyone can access admin)
// 2. register_globals dependency
// 3. SQL injection ($chance, $maxwins, $timesaday)
// 4. No CSRF protection
// 5. No input validation

Overall Code Quality Rating: 4/10

Current Viability

What This Codebase Is Good For Today:

• DHTML Technique Study - CSS layer manipulation educational
• Algorithmic RNG Reference - Modulo win determination is transparent
• Widget Design Pattern - Self-contained embeddable model
• Minimal Footprint Example - 14 files, 40KB proves less is more
• Multi-Language Pattern - Template-based translation system
• Historical Artifact - Represents PHP widget market (2004-2008)

NOT Recommended For:

• Production use (IE-only, massive security holes)
• Learning PHP (teaches dangerous practices)
• Mobile integration (mouse-only, no touch)
• Modern browsers (document.all deprecated)
• Any site handling real money (no authentication)

Requirements to Fire It Up

Minimal Setup (DO NOT USE IN PRODUCTION):

Server Requirements:

• PHP 4.x to 5.6 (PHP 7+ breaks mysql_*)
• MySQL 3.x or higher
• Apache web server
• Internet Explorer 5.5-8 browser (won't work in modern browsers)

Installation Steps:

• Extract to web directory
• Edit config.phtml:

$hostname = "localhost";
$mysqluser = "username";
$mysqlpassword = "password";
$database = "dbname";
$languagefile = "english.phtml";

• Import createtables.sql via phpMyAdmin
• Access scratch.phtml in Internet Explorer only
• Configure via scratchadmin.phtml (no password!)

Critical Issues:

• Won't work in Chrome/Firefox/Safari (document.all is IE-only)
• Admin panel has zero authentication (anyone can modify settings)
• SQL injection in every query
• IP spoofing trivial (X-Forwarded-For header)

Modernization Requirements (PHP 8.4 + Modern Stack)

Estimated Effort: 80-120 hours (2-3 weeks full-time)

1. Frontend Rewrite (40-60 hours)

Critical Changes:

• ❗ Replace IE-specific JavaScript with standard DOM
• ❗ Replace DHTML divs with HTML5 Canvas or CSS animations
• ❗ Add touch support for mobile
• ❗ Implement responsive design

Modern Implementation:

`javascript

// OLD (IE-only):

document.all['M'+i].style.display="none";

// MODERN (all browsers):

document.getElementById('M'+i).style.display = "none";

// BETTER (Canvas):

const canvas = document.getElementById('scratchCanvas');

const ctx = canvas.getContext('2d');

// Draw gray overlay, erase on mouse/touch

`

Canvas-Based Scratch:

• Draw gray overlay as pixel data
• Erase pixels on mouse drag/touch move
• Calculate reveal percentage
• Auto-reveal at 70%+ scratched
• Smooth animations
• Touch-friendly
• All browsers supported

2. Backend Modernization (25-35 hours)

PHP 8.4 Conversion:

`php

// OLD:

mysql_connect($hostname, $mysqluser, $mysqlpassword);

$result = mysql_db_query($database, $query);

// MODERN:

$pdo = new PDO("mysql:host=$hostname;dbname=$database",

$mysqluser, $mysqlpassword);

$stmt = $pdo->prepare("SELECT * FROM kras_params");

$stmt->execute();

`

Security Fixes:

• Replace all mysql_* with PDO
• Implement prepared statements
• Add input validation
• Add authentication to admin panel
• CSRF tokens on forms
• Rate limiting (not just IP tracking)
• Use REMOTE_ADDR securely (validate, don't trust)
• Escape all output

Authentication Required:

`php

// Admin panel MUST require login:

session_start();

if (!isset($_SESSION['admin']) || $_SESSION['admin'] !== true) {

http_response_code(403);

die('Unauthorized');

}

`

3. Database Modernization (8-12 hours)

• Convert to InnoDB (not critical here but standard)
• Add indexes on usr_ip and usr_date
• Add created_at timestamps
• Consider Redis for:
• Current win count (fast increment)
• IP play tracking (TTL-based)
• Parameter caching

Schema Enhancement:

`sql

CREATE TABLE kras_users (

id INT AUTO_INCREMENT PRIMARY KEY,

usr_ip VARCHAR(45) NOT NULL, -- Support IPv6

usr_date DATE NOT NULL,

created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,

INDEX idx_ip_date (usr_ip, usr_date)

) ENGINE=InnoDB;

`

4. Feature Enhancements (15-25 hours)

Modern Features:

• Sound Effects - Scratch sound, win jingle, loss buzz
• Animations:
• Coin shower on win
• Particle effects
• Symbol reveal animation
• Win celebration
• Mobile Optimization:
• Touch-friendly scratch
• Swipe to scratch
• Haptic feedback
• Vertical layout
• Social Features:
• Share win on social media
• Leaderboard (if accounts added)
• Recent winners ticker
• Better RNG:
• Cryptographically secure random (random_int())
• Provably fair system (hash verification)
• Client seed + server seed
• Analytics:
• Play tracking
• Win rate monitoring
• Player behavior analytics

5. Admin Dashboard (12-18 hours)

Modern Admin Panel:

• Secure login system (bcrypt passwords)
• Two-factor authentication
• Real-time statistics:
• Plays today/week/month
• Wins today/week/month
• Win rate percentage
• Top player IPs
• Revenue tracking
• Chart visualizations (Chart.js)
• Parameter adjustment with validation
• Manual win counter reset
• Player IP ban list
• Activity logs

Total Estimated Modernization Cost: $4,000 - $12,000 at industry rates

Verdict: The concept is solid and the DHTML technique was clever for 2004, but the implementation is IE-only and insecure.

Building from scratch would be 40-50% faster:

• Modern scratch: 30 hours (Canvas + touch)
• Backend: 20 hours (Laravel/Express)
• Admin: 15 hours (Vue.js dashboard)
• Database: 5 hours (simple schema)
• Total: 70 hours vs 80-120 hours modernization

The only reusable elements are:

• Concept (virtual scratch cards)
• Algorithm (modulo win determination)
• Graphics (6 symbol JPEGs)
• Database schema concept

Code Quality Assessment Summary

What Works Well:

• Clever DHTML scratch interface (for 2004)
• Simple, focused feature set
• Self-contained embeddable design
• Multi-language support
• Transparent win algorithm
• Admin configuration

What Doesn't Work:

• IE-only (completely broken in modern browsers)
• Zero security anywhere
• No authentication on admin
• SQL injection everywhere
• Ancient PHP functions
• No mobile support
• register_globals dependencies

Grade: C- (Functional in 2004, broken today)

As a 2004 commercial widget, this earned its $50-100 price tag. It delivered a working scratch card feature with minimal setup. However, it won't run in any modern browser (document.all removed) and has catastrophic security if you somehow get it running.

Inherent Dangers of Running This Code

CRITICAL SECURITY RISKS (Severity: 9/10):

1. No Admin Authentication - CATASTROPHIC:

`php

// scratchadmin.phtml has ZERO login check

// Anyone can access: scratchadmin.phtml

// Anyone can modify win rates

`

Attack: Visit scratchadmin.phtml, set kr_chance=1 (100% win rate)

2. SQL Injection Everywhere:

`php

$savequery = "update kras_params

set kr_chance='$chance'";

`

Attack: Set $chance to: 1', kr_total=0, kr_wins=0, kr_max_wins=999999--

3. IP Spoofing Trivial:

`php

$host = $REMOTE_ADDR;

// No validation, easily spoofed

`

Attack: Set X-Forwarded-For header, bypass IP limits

4. register_globals Exploitation:

`php

if ($action == "save") {

// $chance, $maxwins come from GET/POST/COOKIE

}

`

Attack: ?action=save&chance=999&maxwins=999999

5. No CSRF Protection:

`html

`

Result: Admin visits attacker's site, parameters changed

6. Browser Compatibility Failure:

• document.all removed in Chrome 35+
• JScript events never supported in Firefox
• Game simply doesn't work in modern browsers

7. Financial Manipulation:

• Anyone can set 100% win rate
• Anyone can reset win counters
• Anyone can disable play limits
• No audit trail

Real-World Attack Scenarios:

Scenario 1: Admin Panel Takeover (30 seconds)

• Visit scratchadmin.phtml (no password)
• Set kr_chance=1 (100% wins)
• Play 100 times, win every time
• Reset parameters

Result: Drain prize pool, undetected

Scenario 2: IP Limit Bypass (10 seconds)

• Set X-Forwarded-For: 1.2.3.4
• Play 100 times
• Set X-Forwarded-For: 1.2.3.5
• Play 100 times
• Repeat infinitely

Result: Unlimited plays despite IP limits

Scenario 3: Database Manipulation (5 minutes)

`

http://site.com/scratch.phtml?host=1.2.3.4'%20OR%20'1'='1

`

Result: Bypass all restrictions, SQL injection escalation

Risk Level: CRITICAL (for production), LOW (as widget)

Important Context: This was sold as a widget for internal sites, not public gambling. The lack of authentication suggests it was intended for:

• Internal company lottery
• Game integration (like Backyard Boxin)
• Promotional tools
• Non-monetary prizes

For these uses, the security level was "acceptable" in 2004. For any real money gambling, this was always catastrophically insecure.

Innovation & Uniqueness Rating

Innovation Score: 6.5/10 (for 2004)

Standard Elements:

• Scratch card concept (existed physically)
• MySQL storage (common)
• PHP backend (ubiquitous)
• Admin panel (expected)

Uniqueness Score: 5/10

Scratch n Match is one of many scratch card widgets sold in the mid-2000s. The DHTML implementation is creative, but the concept is straightforward. What makes it notable is the execution quality - it's simple, focused, and works (in IE).

Historical Significance:

Represents the PHP widget market (2003-2008) where developers sold small, focused tools:

• Scratch cards
• Polls/surveys
• Guestbooks
• Forums
• Chat systems
• Photo galleries

KPP Internet Promotions (Netherlands) was one of dozens of companies selling such widgets for $25-200 each. The market died with:

• WordPress plugins (free alternatives)
• JavaScript libraries (client-side solutions)
• SaaS services (Wufoo, SurveyMonkey, etc.)

This widget was probably sold for $50-100 and used on hundreds of Dutch websites.

Final Recommendation

Bottom Line:

Scratch n Match was a clever commercial widget for 2004 that delivered exactly what it promised: a self-contained scratch card feature for embedding in websites. The DHTML technique was innovative for avoiding Flash/Java dependencies, and the algorithmic win determination was transparent.

Strengths:

• Creative DHTML implementation
• Lightweight (40KB)
• Self-contained design
• Transparent win algorithm
• Multi-language support
• Simple administration

Fatal Flaws:

• IE-only (completely broken in modern browsers)
• Zero security anywhere
• No admin authentication
• SQL injection in every query
• register_globals dependencies
• Unmaintained since ~2006

Modern Value: Near zero except as:

• Historical artifact
• Teaching example (security anti-patterns)
• Concept reference (scratch card mechanics)
• DHTML technique study (obsolete but clever)

If you need a scratch card feature today:

• Use HTML5 Canvas
• Implement touch support
• Use secure RNG (random_int())
• Add proper authentication
• Use prepared statements
• Build in 30 hours vs trying to fix this

Rating Summary

Historical Value	★★★☆☆ 3/5 - Represents widget economy era
Code Quality	★★☆☆☆ 2/5 - Clever technique, poor security
Innovation	★★★☆☆ 3/5 - DHTML scratch creative for 2004
Security	☆☆☆☆☆ 0/5 - Catastrophic everywhere
Modern Usability	☆☆☆☆☆ 0/5 - Won't run in modern browsers
Widget Design	★★★★☆ 4/5 - Excellent self-contained approach
Overall Grade	D Obsolete but historically interesting