fullermd is exactly right about your problem. As long as you trust the client you you have a security hole. This is not unique to web games.
The issue about it coming your page is irrelevant: when it's MY browser, it is trivial for me to to inject my javascript in YOUR page (I do this routinely). What you really want to do is detect if they're running ONLY your javascript and you can't do that remotely. Heck, I'll just call your function to gimme_refos() and have the high score in no time.
I suspect that most "web games with lots of mouse clicks" don't worry about site wide high score tables for exactly this reason.
-
Are you posting in the right place? Check out Where do I post X? to know for sure.
-
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big>
<blockquote> <br /> <dd>
<dl> <dt> <em> <font>
<h1> <h2> <h3> <h4>
<h5> <h6> <hr /> <i>
<li> <nbsp> <ol> <p>
<small> <strike> <strong>
<sub> <sup> <table>
<td> <th> <tr> <tt>
<u> <ul>
-
Snippets of code should be wrapped in
<code> tags not
<pre> tags. In fact, <pre>
tags should generally be avoided. If they must
be used, extreme care should be
taken to ensure that their contents do not
have long lines (<70 chars), in order to prevent
horizontal scrolling (and possible janitor
intervention).
-
Want more info? How to link
or How to display code and escape characters
are good places to start.
|
