Build / Destroy function design & security checks

I'm working on a browser based strategy game. For the moment I'm working on the build/destroy functions and I have a couple of questions about this. The main question is do you have advice on how I can pass the buildingId and townId to the page where I call the build function? Any advices about the checking I should have in the build / destroy function?

• Morning? It's nearly time to call it a day here... :) – Mac May 24 '12 at 6:29
• :-) it's 9:33 am here :-) for me the day started today at 7:30 :-) – Bogdan May 24 '12 at 6:34

Since this is PHP, you can pass your buildingId and townId as GET data in the URL, i.e.:

build.php?building=39&town=204832


You can then access this with $_GET["building"] and $_GET["town"], which would equal 39 and 204832 respectively in this case.

Your other option is submitting this as POST data (form data) and accessing it using \$_POST["building"]. I don't know of a way in PHP to send POST data other than to have form fields on your page and submit that form (<input type="hidden"> would come in handy here). The only advantage here is that your variables aren't exposed in the URL, but it is does not make anything more secure.

I am not a security expert, but don't trust any information your client gives you. There are a lot of security checks you might want to do and only you (as the game's designer) would know which ones need to be asked. Some likely examples:

• Does the town exist and belong to the user, or do they have permission to build there?
• Does the building they want to build even exist? Can they build it? Can they build it there? If it is a one-of-a-kind building, have they already built it?
• Is there already something built there? Is there room for it?

My ultimate advice would also be that you should not use PHP at all, and instead should create this game in anything else: Python webservice, ASP.NET, JavaServer Pages, take your pick. PHP is an incredibly bad language in all the ways a language can be bad. This is not me having a language bias and hating on a language like how some people hate C++ or Java. This is different. PHP is actually just bad.

• i was looking for new ideeas how to parse the building id and town id so i can go further for inserts, updates, data check and other things like that, and few ideeas about what should i check see if my list is fine or not :) and it is :-D thank you very much for your reply and for the next replies will come during this day :-) – Bogdan May 24 '12 at 7:16
• i'm using pdo driver for the database work related :-) – Bogdan May 24 '12 at 8:05
• Nevermind then, prepared statements with PDO will do well – doppelgreener May 24 '12 at 8:18
• yes i know :-) so far so good yet i'm sad because of all the checkings i need to do some queries to the db :-( and i was hoping to keep it as simple as posible and with a max of three queries :) – Bogdan May 24 '12 at 16:55