将javascript变量传递给php变量的安全问题[重复]

Question

Possible Duplicate:
Preventing fraudulent submission to a scoreboard
Prevent Cheating on Javascript Game

i've found a way to pass my javascript variables to a php variable by using this:

window.location.href = ".../gameover.php?points=" + points+"&speed="+window.speed;

in the gameover.php site i use

$_GET[speed]   // and 
$_GET[points]

to access my variables. these values then get stored into a database as hiscores. but here comes my problem: if the user just types for example

.../gameover.php?points=500000&speed=85

in the address bar it also stores these variables.

i have found something that helps avoiding this but you can still get around it. on my main page i make a cookie 'notcheated' and if the user visits the page and notcheated isset then it destroys the cookie and stores the values in my hiscores but if the user visits the main page and then enters the above address for example then the cookie isset but he hasn't played the game and then the values are also stored.

does someone have any suggestions to secure my site so that people can't just enter their own hiscores.

edit: i have tried to do it with a javascript post but that didn't work. maybe i did something wrong could someone please show me an example on how i should do that?

Answer 1

The only way to prevent this is to have the game logic executed on the server side, within your PHP code. If you send any points value from the client to the server, the user can cheat.

Example:

/sell.php?money=10

The above can be hacked, by changing 10 to 1000000. Instead, consider this:

/sell.php?itemid=1234

The server then handes the removal of the item from the player's inventory, and adds the appropriate amount of money to their account.