I wrote a pretty basic game for colleagues to play : the player shoots on an enemy which has 50 lives while other smaller enemies pop randomly on the screen. The goal is to kill the main enemy as fast as possible.

One important point : the game is written in javascript (using HTML5 canvas).

At the end of the game, I send the score and username to my php function in Ajax, and that's where I have trouble : I find it really hard to restrain my colleagues from cheating.

Here are the different ways of cheating I've noted so far :

  1. Changing the score sent during the ajax call
  2. At the beginning of the game, reducing the number of lives of the enemy
  3. At the beginning of the game, reducing the probability for enemies to appear

Here are the solutions I implemented to counter that cheating :

  1. Create an array that I fill each time I enter the game loop with "delta", the time between that frame and the previous. I send that list to my php save function and then check that the total time of the deltas is equal to the score sent.
  2. Create an array where I store the times when the Enemy loses 1 life. Then in the php save function I check that the list trully has 50 elements, and that the time between 2 elements is not less than a certain value
  3. Create an array where I store the time when an enemy appears. Then in the php save function I check the number of enemies is not less than a certain number.

The 2 first points seem good enough for me : it becomes too much trouble for anyone to try and cheat that. The last point is causing me much trouble. I cannot stop the user from changing apparition rate to 0, then in the ajax call just fill the array with 30 values, that seems pretty easy.

This is my first try with this kind of issue, so I have several questions :

  • Am I on the good way?
  • Are there any "patterns" I am missing for this kind of issue?
  • What would be your approach? What would you do? How to make it even more difficult for the players to cheat?
  • 1
    \$\begingroup\$ gamedev.stackexchange.com/questions/4181/… this may be the kind of thing you're after. But if your game is entirely client side JavaScript and HTML5 then this will probably be quite "crackable". You've got a problem that many of us have problems with, pretty much anything user side can be tampered with and so anything that gets sent to a server can't generally be trusted. This is why most big multiplayer games tend to send up input rather than results (this is very simplified). \$\endgroup\$ – Elliot Blackburn Dec 25 '14 at 0:05
  • \$\begingroup\$ Duplicate, here's the right answer: gamedev.stackexchange.com/a/4189/2188 (pay attention: the accepted one is wrong!) \$\endgroup\$ – o0'. Feb 2 '15 at 14:20