HTTPS, Web Player, WWW - need advice!

Multiplayer & Networking
1

I am building a multiplayer application for the Web Player which sends POST data to a PHP page. I don’t want players tampering with this data or submitting their own requests, so I’m using HTTPS. My understanding is that HttpWebRequest doesn’t work with the Web Player, so I’m using the WWW class.

Thanks to some other forum posts on the topic, I seem to have a working test project here if anyone wants to see the code:
http://pastie.org/1169326 (~30 lines)

I’m pretty stoked that this is working, but I wanted to see if I was overlooking anything as this is my first time setting up HTTPS. Two questions:

1. I don’t have a signed certificate - I simply set the PHP page to use SSL in the IIS Manager. Does this not matter when accessing the page through the WWW class? I did not expect it to work without a valid certificate.

2. I installed Wireshark so that I could view the request transmission and confirm that it’s being encrypted. Is it possible for a user to send a copy of this encrypted message (from an external source) to the PHP receipient, causing the PHP page to execute its response a second time? Or will HTTPS prevent this?

2

Maybe those questions are too specific to get an answer for. My major concern is whether or not it’s safe to base a commercial multiplayer application on HTTPS.

As a contrived example, let’s say my Unity project sends the string “addMoney” to a PHP page, which then contacts the database and adds money to player’s account. Obviously you can’t do this just over HTTP, or someone will use a sniffer to see what data is being sent to the PHP page, and then they can send their own requests to add money to their account. Does using HTTP instead of HTTPS completely prevent this? Or are there still ways to exploit the system?

3

Anyone?