cheat prevention for browser based xmlhttp/js/perl/php game

Question

Lets say that in a browser based game, completing some action (for simplicity lets say someone clicks on a link that increases their score by 100) clicking on this link which would have a url for example increase_score.pl?amount=100 what kind of prevention is there from someone simply sending requests to the web server to execute this command:

1. Over and over again without actually doing the task of clicking on the link and
2. Sending a false request to the server where amount is set to something rediculus like 100000.

I am aware of checking HTTP_REFERER however I know people can get around that (not sure how exactly) and other than some bounds checking for the 2nd option I'm kind of stumped. Anyone ever experience similar problems? Solutions?

Answer 1

Nothing can stop them from doing this if you implement your game how you propose.

You need to implement game logic on the server and assign points only once the server validates the action.

For example: on SO when someone votes your question up, this isn't sent as a command to increase your reputation. The web-app just says to the server user X voted question Y up. The server then validates the data and assigns the points if everything checks out. (Not to say SO is a game, but the logic required is similar.)