[DHTML] Cross-Browser Snake

[mburt]

moving significant portions of the game server-side

Not really, seeings you only need to store two variables (name, and score). You could get the score from the JS code, simply write a variable in js and document.write it and for the name, just use a form.

[Twey]

Nope. Remember that anything in JS is under the control of the user. There's nothing to stop a smart user bumping his/her score up by a couple of thousand points before it gets submitted. The only way to do it would be to actually submit each move to the server for evaluation, rather than relying on JS to calculate the score.

[mitchoum52]

hello !
when i look at what you said it looks to be too much difficult to do...
i think i must give this idea up.
thanks to your answers !
i will probably come here sometimes to see if someone has succeed to do that.
bye !

[datagutten]

In my solution I have a hidden form field that gets value from the JS. When the submit button is pressed, the value is sent to a php script.
As someone said before, it is easy for a skilled user to fake his score with this solution, but I don't think this would be a big problem as if I see someone who has an extremely high score compared with the others, I can just delete it from the DB.

[Twey]

And when that person realises this, s/he will simply set his/her score perhaps five points above the highest. You'd also be running the risk of deleting the score of someone who genuinely is an expert at Snake (and that's someone I'd hate to meet at a party ).

[blm126]

Nope. Remember that anything in JS is under the control of the user. There's nothing to stop a smart user bumping his/her score up by a couple of thousand points before it gets submitted. The only way to do it would be to actually submit each move to the server for evaluation, rather than relying on JS to calculate the score.

Yes, that is probably the only perfect way, but you could, of course, calculate what the maximum possible score is and automatically reject scores over that, and you could also use timestamps to see if it is possible for the user to have gotten that high of a score. I actually thought of doing this before, but realized that if I could think up a way around every single check, then someone else could too

[hypedup.co.uk]

i have just added the snake game to my website. i have put a scoreboard with it. i know others have said that people could fake their scores, but i cant see how they could do it with mine. well there probably is a way if you have the time and inclination, but i cant imagine many people knowing how to do it. i know i am tempting fate now!

i have also improved and made a few changes to the snake game. there are a few bugs which i have fixed, i improved the look of the game, plus i tidied up and reduced the javascript code.

the game is at www.hypedup.co.uk/games/snake.html

[Twey]

i know others have said that people could fake their scores, but i cant see how they could do it with mine.

By POSTing to snake.cgi with an arbitrary value in the cookie. There are some other values your server or various other scripts set in that cookie, too, but I didn't bother checking what they did; I just copied and pasted.
Reproduce: get onto the high score list (or call formfields() manually), then use:

javascript:scoreFrame.document.cookie = scoreFrame.document.cookie.replace(/snake=\d+/, "snake=2222");

... in your browser's address bar. Enter a name and submit.