I'm working on a browser based strategy game. For the moment I'm working on the build/destroy functions and I have a couple of questions about this. The main question is do you have advice on how I can pass the buildingId and townId to the page where I call the build function? Any advices about the checking I should have in the build / destroy function?
Since this is PHP, you can pass your buildingId and townId as GET data in the URL, i.e.:
You can then access this with
$_GET["town"], which would equal 39 and 204832 respectively in this case.
Your other option is submitting this as POST data (form data) and accessing it using
$_POST["building"]. I don't know of a way in PHP to send POST data other than to have form fields on your page and submit that form (
<input type="hidden"> would come in handy here). The only advantage here is that your variables aren't exposed in the URL, but it is does not make anything more secure.
I am not a security expert, but don't trust any information your client gives you. There are a lot of security checks you might want to do and only you (as the game's designer) would know which ones need to be asked. Some likely examples:
- Does the town exist and belong to the user, or do they have permission to build there?
- Does the building they want to build even exist? Can they build it? Can they build it there? If it is a one-of-a-kind building, have they already built it?
- Is there already something built there? Is there room for it?
My ultimate advice would also be that you should not use PHP at all, and instead should create this game in anything else: Python webservice, ASP.NET, JavaServer Pages, take your pick. PHP is an incredibly bad language in all the ways a language can be bad. This is not me having a language bias and hating on a language like how some people hate C++ or Java. This is different. PHP is actually just bad.