security in script

[whackaxe]

i have just asked this question but now im looking at the problem at a larger scale. what i am doing is a single player RPG where the user uses a javascript interface and when he need an action, what happens is that the page calls itself (PHP_SELF) with the GET method for the moment but the problem is the same with POST, for example: when the person chats to a computer controlled user

<a href="engine.php?inst=dial&para1=diana">chat to diana</a>

that will reload the page with the chat to diana initialized. now diana is a very nice person who just says hi but what about if the user uses "inst=level_up". no you see that the user will be able to controll his user arbitrarily which wront be good!

so i was wandering of a way to verify that the user is still on the server because i imagined that what the guy could do is sign in then go to a page on his HD and send in the form (get or post) and it would execute his commands which is lame.

could someone tell me how to get round this threat (apart from abandon the project which is ut of the question :p) i hope ive been clear

[Spookster]

yeah use sessions.

[whackaxe]

yeah but how? i dont see how i can stop the guy from going onto the page and initialising the session and then leave and access his HD and then send the form because the session will still be active wront it?

[Spookster]

To prevent a form from being submitted from anywhere other than your server then create a check_referrer function. Create an array of valid server names like:

array("www.mydomain.com","domain.com")

for example and then check the referring address and if the form wasn't being sent from a domain in the array then stop them. You can also use that to destroy their session if the referrer is not valid.

So for instance.

User logs in - create session
Grab referrer info and store in session
On each page check to ensure user is logged in and if it is a form submission also check for the referrer in the session variable.
If referrer is invalid destroy session and display your message about not trying to cheat.

[whackaxe]

yes but the referrer can be changed so that can be conted on. so the referrer is the best i can get. oh well nevermind ill kust have to whack people who get a to big a score....