PHP+jQuery game security

Question

I am making a game with PHP and jQuery, but I have some problems with security. It's a typing game, and when player types combination correctly, jQuery sends ajax request to PHP and PHP adds 10 points to session. Here is my code:

$('body').on('keyup','.codes_input',function() {
    if($('.codes_input').val() == $('.code').html()) {
        $.post(url+'/save_results',{_token:token});
        points=points+10;
        $('.code').html(randomString());
        $('.codes_input').val('');
        $('.points').html(points);
    }
});

However, my friends could simply do many such $.post(url+'/save_results',{_token:token});requests in chrome extention (if I understood correctly) and got 1000 or even more points (cheating). Is there a way to avoid this? I can't find other way of programming this... Thanks for your help, sorry for my poor english :)

Community · Accepted Answer · 2017-04-13 12:18:41Z

2

Move the logic of evaluating and awarding points to you PHP layer.

Use the jQuery with HTML Websockets just to submit the answer .

As an example architecture, you can have a look at the following:

Javascript and PHP for real-time multiplayer <- Join this SE network
Real Time Multiplayer in HTML5

edited Apr 13, 2017 at 12:18

CommunityBot

11 silver badge

answered Sep 3, 2016 at 15:38

tinonetic

8,03411 gold badges57 silver badges84 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

jkemming · Accepted Answer · 2016-09-03 15:32:15Z

1

Javascript can always be seen by the user, so you cannot really build a secure application like this. The way to go would be to check via Javascript whether the code is correct (as you already do), and then send the code to the PHP script and validate it there as well.

answered Sep 3, 2016 at 15:32

jkemming

71714 silver badges19 bronze badges

8 Comments

Danielius Over a year ago

you mean sending code and input to php file and check there?

jkemming Over a year ago

Yes, and then you return something like a boolean back to Javascript to give graphical feedback to the user. jQuery's $.post can handle that as well, you could for example encode it via JSON.

Danielius Over a year ago

but if attacker can use that $.post in my way, he also can send correct code (var code=$('.code').html();) and php will return true, so result will be same as mine, or I don't understand something? :?

jkemming Over a year ago

You would have to remove the .code element as well. Even without any post requests the user could simply look at your site via e.g. FireBug, find the value and enter it into your input field.

Danielius Over a year ago

and what if i stop game on blur then?

|

Collectives™ on Stack Overflow

PHP+jQuery game security

2 Answers 2

Comments

8 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

8 Comments

Your Answer

Sign up or log in

Post as a guest

Related