I'm creating a browser RPG in Flash which will have some multiplayer elements and in-app purchases so security is a high concern. Would it be better to have all game stats like health and such exist only in the MySQL database and retrieve them every time I need them? The game is turn based, but that would still require very frequent connections to the database. I could use local copies to cut down on the number of connections, but I imagine that would make it much easier for people to cheat.

  • \$\begingroup\$ How does your multiplayer work? Is there an authority in between the players checking whether the input they're sending is valid? That's going to be the critical piece for preventing cheating - it doesn't matter where you store the stats if the player can ignore them and substitute their own without policing. \$\endgroup\$ – DMGregory Mar 10 '18 at 13:44
  • \$\begingroup\$ The game will be mostly single-player but with a multi-player arena for duels, which will NOT be in real time. In other words, the player will be fighting against an AI that uses the name and stats of another player, who may be offline. All the logic will be handled in Flash. \$\endgroup\$ – BladePoint Mar 10 '18 at 13:54
  • \$\begingroup\$ And the results of these duels are stored on the server for later display to the players? \$\endgroup\$ – DMGregory Mar 10 '18 at 14:17
  • \$\begingroup\$ Yes, along with a ranking change, which will also be stored in the database. \$\endgroup\$ – BladePoint Mar 10 '18 at 14:23

"All the logic will be handled in Flash" there's your problem.

It doesn't matter where you store the stats if I can hack my client to ignore them and just always report back "Yeah, I toooottally won that duel. Rank me up!"

To prevent cheating, what you need to do is run your duel logic on the server. Then it doesn't matter if the player hacks their local client to pretend they have 9999999 strength & HP or whatnot. That server does its own calculation with its own authoritative stats, and records/reports the result of the duel with that trustworthy information.

That way a player hacking their local copies of the stats, or any other part of the client, cannot change the game experience for anyone else, nor impact the rankings.

If your duel logic is deterministic, then your client and server don't need to communicate in realtime about the blow-by-blow. The client can still run its own duel logic for presentation to the player. The server can, at minimum, record the player's inputs and the time when the duel was initiated, so it knows what state to use whenever it decides to compute the outcome later (when it has time / when a player asks to see the results).

| improve this answer | |
  • \$\begingroup\$ I figured everything would have to be handled server side including the logic to make things completely secure. I suppose that's how all MMOs do it. Doing things that way is a bit beyond my abilities though. I'm familiar with Actionscript-3, but I'm just starting to learn PHP and MySQL. \$\endgroup\$ – BladePoint Mar 10 '18 at 14:30
  • \$\begingroup\$ Is PHP enough to securely handle the duel logic? Flash handles the player input, PHP pulls the player and opponent stats from the database, does some math, throws in a random number or two, and returns the result to Flash? \$\endgroup\$ – BladePoint Mar 10 '18 at 14:44
  • \$\begingroup\$ What are you worried might be insufficient about it? \$\endgroup\$ – DMGregory Mar 10 '18 at 14:46
  • \$\begingroup\$ I was just wondering if that would be a good way to do it. I'm currently using a free webhost that provides PHP and MySQL to test my game, but once I'm paying for my own hosting, I guess I should pay attention to the number of PHP/MySQL requests that I'm doing. \$\endgroup\$ – BladePoint Mar 10 '18 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.