For the turn-based browser Flash RPG I'm working on, I'm keeping all player stats in a MySQL database, with PHP as the go-between, for the sake of persistence and to prevent cheating by memory editing. But then it occurred to me that someone could cheat by hacking the client as well by, for example, repeatedly calling the function which adds gold to the database by posting arguments to a PHP page. That means I have to do all logic on the PHP server to prevent that.
Is that a feasible thing to do? My end goal is to have a commercial game that could have a large number of people playing at the same time, and I assume I need to be mindful of the number of operations being performed on the PHP server as well as the number of queries being made to the MySQL database. Although when I look at various web hosting providers that provide PHP and MySQL, none of them seem to mention any limitations on those two things. I'm hoping speed won't be an issue as well. On the free test server I'm using, it takes a couple seconds to get a result back from the database, but you get what you pay for.