[Rainer Deyke]

First rule of server security: never trust the client. You have no way of knowing if the user is even using a web browser. Your only hope is to keep all confidential data on the server, and to validate all input on the server.

[Nephilim]

Yeah, what he said. The server should know where the player is, and should be able to determine if the move is a legal one. It doesn't matter whether the *requests* to do something in the game come from a web browser, a terminal client, or whatever, so long as the server enforces the rules as the requests come in.

In other words, the interface you present to the player is just a dumb terminal that has no power to affect the game world - all it does is present the current view and communicate the command the player wants to take. All world modeling should happen on the server - if a nonsensical command comes in, then ignore/log it.

(Of course, if you allow players to freely add and modify rooms, quests, monsters, and items, isn't it kind of pointless to try to counteract cheating? Depending on the nature of construction you want, it might be worth it to just open up the command architecture and *encourage* people to take advantage of it.)

You might also look into technologies like SOAP and XML-RPC to allow interactions with your game world. Might be a more elegant and expandable solution, especially when it comes to scripting the game world.
_________________
Visit the Sacraments web site to play the game and read articles about its development.