Should clients in an online game access the database directly or through a game server?

Question

first im total noob about c# and mysql. Just trying to find which way is better. i believe your answers prevents me from losing plenty of time.

• Online game(not more than 50 users at pre-alpha. Not expecting than 500+ at the end.)
• Text based game / console like ( minimum graphics )
• PVP -> Players are able to destroy other players.
• Simlpy a hacking simulation.
• There will be some servers.(NPC servers and player made servers)
• players can reach that servers made by other players.

Q: Which one is the good way to store that servers data?

game client --> Mysql server ?
or game Client --> a Server Client(which is localy running a mysqL server)

If it's totaly wrong to use mysql server how can i make it? Thank you...

Answer 1

First of all, I think this question belongs more likely to Security.SE since you are asking about to expose or not a public database server.

Said that, I strongly recommend to NEVER, EVER AND EVER expose publicly a database server unless you know what you are doing and you know who you grant access. The key reason to recommend that is security and integrity of the database. Take a look around these tags on Security.SE to get an idea of what could happen:

• databases on Security.SE
• sql-server on Security.SE

Another reason to not to connect to a database server through the Internet is performance. Most databases servers' access protocols are so heavyweight to use as those tend to keep the connection alive, which is a end-to-end resources waste unless you close the connection explicitly.

Since you are developing a text-based game in the way that a player enters a command and waits to receive a response before thinking about the next step, a better way to manage your game data and make it accessible to your users could be to develop a public HTTP(S) REST API on your server with session control that provides a secure interface between your database server and your players game client.

EDIT: Other reason to develop a HTTP(S) REST API for your online game is because this way you will be able to develop and deploy your game for other devices and OSes, like Android and iOS, which doesn't allow the apps to open outgoing connections with most of (if not every) database server protocols.

Answer 2

Having a client connect to a database directly is never a good idea for security reasons.

Keep in mind what audience you attract and in what mindset you put them when you create a hacking-themed game. They will try to find security vulnerabilities in your game. Some might even mistake it for the intended way of playing it. So you need to implement security-by-design from the get go.

The permission handling system of MySQL is not fine-grained enough to control what the client can and can't do on a field level. You don't want me to do a query like UPDATE scores SET score = 99999999999 WHERE player = "Philipp". You will need to do a plausibility check first if I actually did something to deserve that score. Actually, you shouldn't allow me to tell the server my score at all. All I should be able to send to the server is what I intend to do. The server then calculates

1. if I actually can do that right now
2. what effects my action has on the game state
3. which of these effects I should know about

and then tell me the result.

And you certainly don't want me to execute queries like DELETE players WHERE player = "Corviuse".

And please don't believe that you can control what the player can and can't do and know about on the client. The player could simply develop their own client software, which does not sound particularly hard considering that you intend it to be "Text based game / console like ( minimum graphics )". There is no way for you to check if the player is actually running your software or a clone of it.

That being said, it is possible to implement all these checks I wrote above as stored procedures in MySQL and only give players the permission to interact with the database through these stored procedures. But stored procedures are an advanced feature of relational databases and the language is not vey suitable for writing complex game mechanics. So when you are a "total noob" as you say you will likely have enough on your plate with writing normal SQL queries.